Analysis
-
max time kernel
172s -
max time network
175s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
07-08-2022 12:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dropmefiles.com/r6TC4
Resource
win10-20220414-en
General
-
Target
https://dropmefiles.com/r6TC4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
VMUnprotect.Dumper.exepid process 3240 VMUnprotect.Dumper.exe -
Processes:
resource yara_rule C:\Users\Admin\Desktop\net472\net472\1.bin vmprotect behavioral1/memory/3240-126-0x00000200339E0000-0x00000200342A6000-memory.dmp vmprotect C:\Users\Admin\Desktop\New folder\1.bin vmprotect -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 2180 chrome.exe 2180 chrome.exe 1312 chrome.exe 1312 chrome.exe 3548 chrome.exe 3548 chrome.exe 4884 chrome.exe 4884 chrome.exe 3320 chrome.exe 3320 chrome.exe 4032 chrome.exe 4032 chrome.exe 4264 chrome.exe 4264 chrome.exe 5064 chrome.exe 5064 chrome.exe 4380 chrome.exe 4380 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe 2868 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
chrome.exepid process 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
7zG.exe7zG.exedescription pid process Token: SeRestorePrivilege 656 7zG.exe Token: 35 656 7zG.exe Token: SeSecurityPrivilege 656 7zG.exe Token: SeSecurityPrivilege 656 7zG.exe Token: SeRestorePrivilege 4012 7zG.exe Token: 35 4012 7zG.exe Token: SeSecurityPrivilege 4012 7zG.exe Token: SeSecurityPrivilege 4012 7zG.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
Processes:
chrome.exe7zG.exe7zG.exepid process 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 656 7zG.exe 4012 7zG.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe -
Suspicious use of SendNotifyMessage 42 IoCs
Processes:
chrome.exepid process 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe 1312 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1312 wrote to memory of 1296 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 1296 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2096 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2180 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2180 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe PID 1312 wrote to memory of 2476 1312 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://dropmefiles.com/r6TC41⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe56804f50,0x7ffe56804f60,0x7ffe56804f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,13627379167447958470,5526561302827988694,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:12⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\net472\" -ad -an -ai#7zMap13173:68:7zEvent300451⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\net472\net472\VMUnprotect.Dumper.exe"C:\Users\Admin\Desktop\net472\net472\VMUnprotect.Dumper.exe" C:\Users\Admin\Desktop\net472\net472\1.bin1⤵
- Executes dropped EXE
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap9489:70:7zEvent13326 -ad -saa -- "C:\Users\Admin\Desktop\New folder"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\New folder.7zFilesize
5.8MB
MD50d5fc574dd99c7ba7465a5423f3ed188
SHA1188eb67de548f3e8b68fe9005506ad9d83eb1f8a
SHA2565f4f160edd0274163e37c163dfa9d0c51936be0baab018fbfcf7128a7584555b
SHA5129e7dca5802b9322875190ce38da8a09e41e03b7d20c6bc3c0fa932fa2e2e97ab8070e33aef47a86f728aa408a31290025ca3b9cf793c49a6d57f5d9f9e11cfc7
-
C:\Users\Admin\Desktop\New folder\1.binFilesize
8.7MB
MD5d9257bf9a73f2c15dd70839d4a361867
SHA1bfe8db4d560193f57e6acb64c17f638dfa8ca430
SHA256001629ef786a09fac773dc89bfe09dfcf1e0b1621b076107ec0b4735ce530506
SHA512388a3f52fa73c5e3a8b7e73fdbd62ab1a360f193c3621f7da63a5f441b9d540d1df386b6bca9a668fc8375a249c3e6c59a502d26619a6a49c52715615f964c4f
-
C:\Users\Admin\Desktop\net472\net472\1.binFilesize
5.9MB
MD547513f8c8d3ede4e8cff4cdc8e987298
SHA1ccd7a2cdf6b8c8ce58ea1038c9e21b402ee08d0a
SHA2568b8ecfea5b1f80d43eb3b9d55f5841b18c4ce6c0b475a44c7cf1565c4883b99d
SHA5129a9b2bfa9725c8641fd800e8d9eae08d4432b9d853c207f77d5e29649e0ef05ee788fc06f5b272461ae391178674cc67dd06c874e361e8d35fca3fb38389fb25
-
C:\Users\Admin\Desktop\net472\net472\AsmResolver.PE.File.dllFilesize
39KB
MD588e04b693f32034ebd0aed035a388938
SHA14984f8329d8a354ec83a4557cf0e128677bd5779
SHA2567fc351b4329315714d48ce5bb5462f92730612cf94aeb437bd705af6ae6595c4
SHA51279141d0231a479b10791c9f498fd5e43c96e27379dab6cc546fec08c7d019431d236b5db3b8f6a135b0958ce9e770fce9e3081ef5e32b5be2925b6f2fb86a3d4
-
C:\Users\Admin\Desktop\net472\net472\AsmResolver.dllFilesize
46KB
MD5728772243d1612663afe962af61ff46f
SHA1598e33021ca17d240881804b39d4eb6782f874ec
SHA2569ad68c79de372403a1e3962e1d11453dff96a55e4f65ad6650e6d44525917627
SHA5120031023e089c8cbf12c36f7c6d01a910313c33caec69ab5dbf4e62eed675cc82c10fb5b02c1b3d52a80031c644fe4963ce82fa3e23a459eec03a1a9581f6ff6a
-
C:\Users\Admin\Desktop\net472\net472\VMUnprotect.Dumper.exeFilesize
7KB
MD532ad7a3e2248faedb841e1d4f9a9c1c0
SHA1357dfed1a425ffc011c5a5539e08d5300c53d43f
SHA2565ecc252fde2462c92e4eb5c39bf4492b9b79418e908c590f4c5458157add1b13
SHA5120db9db8dea5026762e727bf0c2a3c66b2f5aacdbc6cdeaef027d1c6d6f233e0dd4271c9bf1c47f8e4ecc9a470a0a7fcd78e26a9f3eab6ac56b2afa7bacd59168
-
C:\Users\Admin\Desktop\net472\net472\VMUnprotect.Dumper.exeFilesize
7KB
MD532ad7a3e2248faedb841e1d4f9a9c1c0
SHA1357dfed1a425ffc011c5a5539e08d5300c53d43f
SHA2565ecc252fde2462c92e4eb5c39bf4492b9b79418e908c590f4c5458157add1b13
SHA5120db9db8dea5026762e727bf0c2a3c66b2f5aacdbc6cdeaef027d1c6d6f233e0dd4271c9bf1c47f8e4ecc9a470a0a7fcd78e26a9f3eab6ac56b2afa7bacd59168
-
C:\Users\Admin\Desktop\net472\net472\VMUnprotect.Dumper.exe.configFilesize
553B
MD50958b562d9b72449e0af3bb25f1e6cb2
SHA1923f65f18d1dfaa0d18b9729b750e2a7c724151d
SHA25685ac7a12649ae9331aa8415276d859e87b6b1a895b25779995c06dee2d5dcf1b
SHA51250fd2d9d8fd588fba4891203a8c57c46d409fad20d76f7416e8810eafc6d6f3223acd18b34c568aed3c302c8b1bb31290ce70256f06424ef9dcb95b80fd741dd
-
\??\pipe\crashpad_1312_ZSIYUCNQSJXXYVYHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3240-121-0x0000020017840000-0x0000020017850000-memory.dmpFilesize
64KB
-
memory/3240-124-0x0000020019270000-0x0000020019282000-memory.dmpFilesize
72KB
-
memory/3240-126-0x00000200339E0000-0x00000200342A6000-memory.dmpFilesize
8.8MB
-
memory/3240-127-0x00000200192A0000-0x00000200192A8000-memory.dmpFilesize
32KB
-
memory/3240-122-0x0000020019250000-0x000002001926A000-memory.dmpFilesize
104KB
-
memory/3240-119-0x0000020017640000-0x0000020017648000-memory.dmpFilesize
32KB