Overview
overview
10Static
static
10Discord To...rd.exe
windows7-x64
7Discord To...rd.exe
windows10-2004-x64
8Discord To...ain.py
windows7-x64
3Discord To...ain.py
windows10-2004-x64
3Discord To...OR.dll
windows7-x64
1Discord To...OR.dll
windows10-2004-x64
1Discord To...hy.dll
windows7-x64
1Discord To...hy.dll
windows10-2004-x64
1Discord To...to.dll
windows7-x64
1Discord To...to.dll
windows10-2004-x64
1Discord To...on.dll
windows7-x64
1Discord To...on.dll
windows10-2004-x64
1Discord To...le.exe
windows7-x64
3Discord To...le.exe
windows10-2004-x64
3Discord To...pp.xml
windows7-x64
1Discord To...pp.xml
windows10-2004-x64
1Discord To...rv.exe
windows7-x64
9Discord To...rv.exe
windows10-2004-x64
9Discord To...ram.js
windows7-x64
1Discord To...ram.js
windows10-2004-x64
1Discord To...er.vbs
windows7-x64
1Discord To...er.vbs
windows10-2004-x64
1Discord To...es.vbs
windows7-x64
1Discord To...es.vbs
windows10-2004-x64
1Discord To...csproj
windows7-x64
3Discord To...csproj
windows10-2004-x64
3Discord To...LI.exe
windows7-x64
1Discord To...LI.exe
windows10-2004-x64
1Discord To...re.dll
windows7-x64
1Discord To...re.dll
windows10-2004-x64
1Discord To...er.dll
windows7-x64
1Discord To...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2022 21:51
Static task
static1
Behavioral task
behavioral1
Sample
Discord Toolz/Discord.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Discord Toolz/Discord.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Discord Toolz/Utils/API's/Autoctu/main.py
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Discord Toolz/Utils/API's/Autoctu/main.py
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Discord Toolz/Utils/API's/Resources/APIFOR.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Discord Toolz/Utils/API's/Resources/APIFOR.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
Discord Toolz/Utils/API's/Resources/Anarchy.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Discord Toolz/Utils/API's/Resources/Anarchy.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Discord Toolz/Utils/API's/Resources/BouncyCastle.Crypto.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Discord Toolz/Utils/API's/Resources/BouncyCastle.Crypto.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
Discord Toolz/Utils/API's/Resources/Newtonsoft.Json.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Discord Toolz/Utils/API's/Resources/Newtonsoft.Json.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Discord Toolz/Utils/API's/Resources/UltraEmbeddable.exe
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
Discord Toolz/Utils/API's/Resources/UltraEmbeddable.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Discord Toolz/Utils/API's/bin/App.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Discord Toolz/Utils/API's/bin/App.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Discord Toolz/Utils/API's/bin/Binaries/RtkBtManServ.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Discord Toolz/Utils/API's/bin/Binaries/RtkBtManServ.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Discord Toolz/Utils/API's/bin/Program.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Discord Toolz/Utils/API's/bin/Program.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Discord Toolz/Utils/API's/bin/Properties/Resources.Designer.vbs
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
Discord Toolz/Utils/API's/bin/Properties/Resources.Designer.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Discord Toolz/Utils/API's/bin/Properties/Resources.vbs
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Discord Toolz/Utils/API's/bin/Properties/Resources.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Discord Toolz/Utils/API's/bin/TOKEN STEALER CREATOR.csproj
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Discord Toolz/Utils/API's/bin/TOKEN STEALER CREATOR.csproj
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
Discord Toolz/Utils/API's/bin/obf/CLI.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Discord Toolz/Utils/API's/bin/obf/CLI.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
Discord Toolz/Utils/API's/bin/obf/Confuser.Core.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
Discord Toolz/Utils/API's/bin/obf/Confuser.Core.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Discord Toolz/Utils/API's/bin/obf/Confuser.DynCipher.dll
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
Discord Toolz/Utils/API's/bin/obf/Confuser.DynCipher.dll
Resource
win10v2004-20220812-en
General
-
Target
Discord Toolz/Discord.exe
-
Size
104KB
-
MD5
7590651986e34b8379d95a6cbab94ccf
-
SHA1
f9584d626ad68a9c92afc4fd7f371f2dd8eb00e5
-
SHA256
5b72b2d1dbc5e69375720566c0b2e7a3134ab08fd8fd9d465b7527aa29c6f30f
-
SHA512
0dc46b7318c50d9b4990f3a3d9fa906d918ec1404945158535e80efbd03b2e7eb3f138526f0734cea09a5f30e51a1e009e6d0893b69be308334dbfebbf76aeca
-
SSDEEP
3072:eIcfsUia8dd824+xG99U1C1Zq7IoQx0fZlSi3:8fsUiaqd8RgGMy4conS
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Discord.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Discord.exe -
Loads dropped DLL 1 IoCs
Processes:
mhyispdl.exepid process 1300 mhyispdl.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings chrome.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1192 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 1372 chrome.exe 1372 chrome.exe 4016 chrome.exe 4016 chrome.exe 2064 chrome.exe 2064 chrome.exe 2796 chrome.exe 2796 chrome.exe 2084 chrome.exe 2084 chrome.exe 2656 chrome.exe 2656 chrome.exe 4104 chrome.exe 4104 chrome.exe 3440 chrome.exe 3440 chrome.exe 4100 chrome.exe 4100 chrome.exe 3800 chrome.exe 3800 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
chrome.exepid process 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mhyispdl.exedescription pid process Token: SeDebugPrivilege 1300 mhyispdl.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
Processes:
chrome.exepid process 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe 4016 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mhyispdl.exepid process 1300 mhyispdl.exe 1300 mhyispdl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Discord.exechrome.exedescription pid process target process PID 1904 wrote to memory of 1300 1904 Discord.exe mhyispdl.exe PID 1904 wrote to memory of 1300 1904 Discord.exe mhyispdl.exe PID 1904 wrote to memory of 1300 1904 Discord.exe mhyispdl.exe PID 4016 wrote to memory of 912 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 912 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 3340 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 1372 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 1372 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe PID 4016 wrote to memory of 4228 4016 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Discord.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Utils\API's\mhyispdl.exe"C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Utils\API's\mhyispdl.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yvaefa0l\yvaefa0l.cmdline"3⤵PID:4708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd788d4f50,0x7ffd788d4f60,0x7ffd788d4f702⤵PID:912
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:22⤵PID:3340
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 /prefetch:82⤵PID:4228
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:12⤵PID:2144
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:12⤵PID:3732
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:12⤵PID:4688
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4444 /prefetch:82⤵PID:2800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4576 /prefetch:82⤵PID:2132
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:82⤵PID:2380
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:3940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:82⤵PID:3900
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:82⤵PID:3932
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:82⤵PID:1616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:2996
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:82⤵PID:3948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=896 /prefetch:82⤵PID:3964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:2808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:3436
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:82⤵PID:4028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2800 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:2684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4304
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵PID:1140
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:1988
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:82⤵PID:4136
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\1.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1192 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:4396
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,11025608293541432091,8560103577596139131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:1908
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
C:\Users\Admin\Downloads\1.txtFilesize
121B
MD56155cb9c3e16a9887b7c742980cfd354
SHA1422c2807c5bbc84cfcf4239fc95b664dbb9b13ce
SHA256af52593d49f4f372745ff992d84e76f2a0331e25929b493e25147a9f8f2f07ab
SHA512474d623f8cddbf5808ba89ec49f2e043dfc4613789a024afc56fb57fd9f49447ad487b0140ed9d1b70a79f413040429263a86f34b5d237fe139ff6be51a8d48c
-
\??\c:\Users\Admin\AppData\Local\Temp\yvaefa0l\yvaefa0l.cmdlineFilesize
1KB
MD59e227c6beaaf82bbcbdf8d33a8425d19
SHA1f20dff8e7327df15ba68f16fe1bbd7098e2f6d52
SHA256e8de2a8a555cfdcfb16dd6effedf8637973fd2df39f4341c07f53156402118c3
SHA51264c2b3816e1693fc7e52677ca1782d367bea832bd87227b53e2a816e294125da52de6cb0f93d347fcac3ee3c5b81709839e4b2589a098628f27d693b83f44ee8
-
\??\pipe\crashpad_4016_WWZAOGSQKMOJVHXYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1192-145-0x0000000000000000-mapping.dmp
-
memory/1300-137-0x0000000000870000-0x0000000000A60000-memory.dmpFilesize
1.9MB
-
memory/1300-147-0x0000000000F40000-0x0000000000F5A000-memory.dmpFilesize
104KB
-
memory/1300-140-0x0000000006360000-0x00000000063FC000-memory.dmpFilesize
624KB
-
memory/1300-141-0x000000006F750000-0x000000006F787000-memory.dmpFilesize
220KB
-
memory/1300-139-0x00000000731D0000-0x0000000073259000-memory.dmpFilesize
548KB
-
memory/1300-143-0x000000006F750000-0x000000006F787000-memory.dmpFilesize
220KB
-
memory/1300-136-0x0000000000000000-mapping.dmp
-
memory/1300-149-0x00000000054F0000-0x000000000552C000-memory.dmpFilesize
240KB
-
memory/1300-148-0x0000000001010000-0x0000000001022000-memory.dmpFilesize
72KB
-
memory/1904-132-0x0000000000770000-0x0000000000790000-memory.dmpFilesize
128KB
-
memory/1904-134-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/1904-135-0x0000000005010000-0x000000000501A000-memory.dmpFilesize
40KB
-
memory/1904-133-0x0000000005650000-0x0000000005BF4000-memory.dmpFilesize
5.6MB
-
memory/4708-150-0x0000000000000000-mapping.dmp