hxxps://cdn[.]discordapp[.]com/attachments/1026200867436765254/1026201285252362291/videoplayback[.]mp4

Analysis

max time kernel
192s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 18:42

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1026200867436765254/1026201285252362291/videoplayback.mp4

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1112	vlc.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe
2220	chrome.exe
2220	chrome.exe
4564	chrome.exe
4564	chrome.exe
4520	chrome.exe
4520	chrome.exe
5104	chrome.exe
5104	chrome.exe
4904	chrome.exe
4904	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1112	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	taskmgr.exe
Token: SeSystemProfilePrivilege	4904	taskmgr.exe
Token: SeCreateGlobalPrivilege	4904	taskmgr.exe
Token: 33	4904	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4904	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
4564	chrome.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
1112	vlc.exe
3388	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4192	1724	chrome.exe	82
PID 1724 wrote to memory of 4192	1724	chrome.exe	82
PID 4564 wrote to memory of 4820	4564	chrome.exe	85
PID 4564 wrote to memory of 4820	4564	chrome.exe	85
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 1724 wrote to memory of 1948	1724	chrome.exe	89
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88
PID 4564 wrote to memory of 5036	4564	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://cdn.discordapp.com/attachments/1026200867436765254/1026201285252362291/videoplayback.mp4
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff964c64f50,0x7ff964c64f60,0x7ff964c64f70
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,2806480198843296016,3975839147116589518,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1604 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,2806480198843296016,3975839147116589518,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff964c64f50,0x7ff964c64f60,0x7ff964c64f70
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\videoplayback.mov"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1528 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,13987883305689388164,16312763222310658439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1e71d581e241477f9d7b2a0e6ca8a39d /t 1368 /p 1112
1⤵
PID:4980

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a3a937930c5b01ecd542f094135aa0a4

SHA1
79234b7656f2a562129f98b27bc0762dc867d7fa

SHA256
985145fe40ae859f59ca7f31f100fe1a194f21810f50f5fd26c4c73c25b03ff9

SHA512
7fa94881f580973ffe4c6b67b811d47e7c104681b1fb8b36c6754ca0d29e731e89c252a9ea62e1888edf2eb3ffc8aa9f6462ed78f61c9683ddbe0d3f50f7ca41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a3a937930c5b01ecd542f094135aa0a4

SHA1
79234b7656f2a562129f98b27bc0762dc867d7fa

SHA256
985145fe40ae859f59ca7f31f100fe1a194f21810f50f5fd26c4c73c25b03ff9

SHA512
7fa94881f580973ffe4c6b67b811d47e7c104681b1fb8b36c6754ca0d29e731e89c252a9ea62e1888edf2eb3ffc8aa9f6462ed78f61c9683ddbe0d3f50f7ca41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a3a937930c5b01ecd542f094135aa0a4

SHA1
79234b7656f2a562129f98b27bc0762dc867d7fa

SHA256
985145fe40ae859f59ca7f31f100fe1a194f21810f50f5fd26c4c73c25b03ff9

SHA512
7fa94881f580973ffe4c6b67b811d47e7c104681b1fb8b36c6754ca0d29e731e89c252a9ea62e1888edf2eb3ffc8aa9f6462ed78f61c9683ddbe0d3f50f7ca41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
88KB

MD5
afe613355dbe033e920b15eea7b46d25

SHA1
07e2933c68b1f650cd870f0c67627afcbe69afb3

SHA256
54195f07722c5b29322f83663edb9f05cb4f7a4fd5c75d755ca374b0ab31910f

SHA512
c558a18dad4c660e9ba8fe29e4df581e24f5de1c17fc86c3e7e469d099bf08e158583e44c01494274aa11b9e2a37100245fa7b6d7dd14dfd0dde5ee703c5bb05

Download Submit
C:\Users\Admin\Downloads\videoplayback.mov

Filesize
526KB

MD5
b5b851b34ff136ab6964014076180a42

SHA1
2e17acacf966a854a8e958ac2413854aa374dbb5

SHA256
faa13e1a3ad383fb353bafecd6836c015edbc20014102df8298eaad10727902c

SHA512
b47d35c749f802c57a26a041c64ecb89e9a0d22b2e4bcb7e283910c8d4cb131e2d504c528bbb02284d73838951b582bf0a761bd13340f38492d924cea37c35db

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads