12060fee84ac6a9193e8f6d21db3ec92910d795724d1e81d3b51e4b9f3029bcb

Resubmissions

19-10-2022 10:05

221019-l4pslsfbh5 3

17-10-2022 13:00

221017-p8metsbhb9 3

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12060fee84ac6a9193e8f6d21db3ec92910d795724d1e81d3b51e4b9f3029bcb-vt-file.pdf
Size

70KB
MD5

b3e3c962afc1e08cb7037fd7aceda562
SHA1

637f321a9cb6371f2396ca5327d75230a4516fc8
SHA256

12060fee84ac6a9193e8f6d21db3ec92910d795724d1e81d3b51e4b9f3029bcb
SHA512

33ece2fe2d0d0a9851788e0e8d8e439e2d341e295d099a7e92a5382b988deb327adbcdf6091e2d9d28cbbd8254ce1722e16b49ee0f731314e5157f71434d4f22
SSDEEP

1536:dx12cbJdAWFxVsgbWxELRX55HryW4XCMMayyA/1DgWXtAyqGhC9+:F7bEOxbCxELRX55OpyMMXyAtvpqiD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0435143b3e3d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{664CE411-4FA6-11ED-8B83-6A6CB2F85B9F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000b81cd0a27e89bf7f6ed916d72e813d3303f6f219179979fb2a820aa1f25d322e000000000e80000000020000200000006910080c067b11216d6645b4a80477a5b86c753a2e49083665c2db34d6f0ca5620000000d5f49109a7bb744f129d21a732ea1648c89b196499de132a8f68ba960b7046c2400000003e85bf249a6176d57840560ed30104474ae8712c3ffe1fe5f66fb3ee663f741bb3ec8e9a7010b23155fc734d70776363d35cc2e19e8e110b8e033aafa793a65e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000003b29e8e491f22e744f6492172b8532c4ae0a656136a5138318b10d1666390da8000000000e8000000002000020000000325032d40461dd704c7e985e6257688c012f2c3eb4599215a3dff9ce4e34a4e69000000060c160f8a4cac7f13df86339aa19359fc8b07b939af34073361d8c09383a9439a688130a1c910856d47861d9cf1b4fc3ae6150576c63279846694314b79badbc0405e413a0e7ee483b09cfb64a552916492c6fefb27964e15065ac8c7835bb2b5209407af50c73f55687cbe02d396393888c067bfd31276009f27ffaed671b663f588cf00aa12c4096cebba721deb8054000000071c33b6c053a5983cb2e3170e487c1c0c5c9b720de32d1fe5419d59001f725edcb8505e9d75d1de54c8ccb3a1b930ef5b774efbe5396d58ece16f08a6326d687	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

chrome.exechrome.exe

pid process

1116 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe
1436 chrome.exe

pid	process
1116	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

Processes:

iexplore.exechrome.exe

pid	process
908	iexplore.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

chrome.exe

pid	process
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
1612	AcroRd32.exe
1612	AcroRd32.exe
1612	AcroRd32.exe
1612	AcroRd32.exe
908	iexplore.exe
908	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
908	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeiexplore.exechrome.exe

description	pid	process	target process
PID 1612 wrote to memory of 908	1612	AcroRd32.exe	iexplore.exe
PID 1612 wrote to memory of 908	1612	AcroRd32.exe	iexplore.exe
PID 1612 wrote to memory of 908	1612	AcroRd32.exe	iexplore.exe
PID 1612 wrote to memory of 908	1612	AcroRd32.exe	iexplore.exe
PID 908 wrote to memory of 1932	908	iexplore.exe	IEXPLORE.EXE
PID 908 wrote to memory of 1932	908	iexplore.exe	IEXPLORE.EXE
PID 908 wrote to memory of 1932	908	iexplore.exe	IEXPLORE.EXE
PID 908 wrote to memory of 1932	908	iexplore.exe	IEXPLORE.EXE
PID 1436 wrote to memory of 2008	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 2008	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 2008	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1652	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1116	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1116	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1116	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe
PID 1436 wrote to memory of 1408	1436	chrome.exe	chrome.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\12060fee84ac6a9193e8f6d21db3ec92910d795724d1e81d3b51e4b9f3029bcb-vt-file.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://traffine.ru/strik?utm_term=sos+emergency+appointment
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:908 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69a4f50,0x7fef69a4f60,0x7fef69a4f70
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3320 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,13823006487824101310,15082598933315468735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 /prefetch:8
  2⤵
  PID:2876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
300B

MD5
bf034518c3427206cc85465dc2e296e5

SHA1
ef3d8f548ad3c26e08fa41f2a74e68707cfc3d3a

SHA256
e5da797df9533a2fcae7a6aa79f2b9872c8f227dd1c901c91014c7a9fa82ff7e

SHA512
c307eaf605bd02e03f25b58fa38ff8e59f4fb5672ef6cb5270c8bdb004bca56e47450777bfb7662797ffb18ab409cde66df4536510bc5a435cc945e662bddb78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C084C1B0D2CCBD34CAD598D6D7BE0B

Filesize
346B

MD5
0d9d9d0a123d8f10041f4e0b18eca59c

SHA1
eec1ada1acb12d4324014cc7e315f78b570c3331

SHA256
f238756be9ef613e536bae73a08327a497c3146bcd21ada5ebfe00b9c32ee33e

SHA512
9de7173eab411591acfe3b2c3a8a64782dc23dbdbb0da03ab1720a72e0d667fe6c0b6acc66473d41f1f10254357f2f44ff8eba4395e9beb593d6ce0e52a80c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
a0d0a3486087601c44f868a62f297823

SHA1
0000bda16ad03915b184e7158e46b68c9f5a8733

SHA256
71c211a2e75cd0b5e6f8aafa44ab0bdea6da13ed903ec6db15d3ebaf3c3d29f8

SHA512
c987a64dc393b5e7b7b3dddcc39302d4b46851bfbc9b0edca4cf20f41e67db118ba354bdcc987587f152602be215c3deb2b806788344ac476c5e2e2b9f48ab09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
1f10519c2271eb75eb8982a253075dca

SHA1
82076b232fbdbcb97dc5977b1789b5c9f1233c8d

SHA256
528caa2d948575ba8bfec56b8a55a7f6c426e0c74d08772941e836fe2507e636

SHA512
9397ecbee5f9dbf468355a6dd2923b8521669473a2eff4bc853fca6bb89d8714289e78d8ffd679de9e8311c00b50944343a3652cddd46799ccf51e9293696e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c49ef914d305908adfb28d8455e6fec9

SHA1
334daa2fbfc119a4159387beb629af04cd3cb35e

SHA256
9cc96bb553f4750ec06f2c945ec1a8f8ee480fc8cb53d1f13b07061feedd650e

SHA512
3c33e48f980dcb5e4b6105458959ea44af90977e4611813d70f0fd9714860e362d23cc546100e06aef1fae647f8303e0ca24a6ec6fecd0048f38fddff7675fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C084C1B0D2CCBD34CAD598D6D7BE0B

Filesize
540B

MD5
538be48312dcf3771377b6dc67b2f2ce

SHA1
6581cb0ca4b823273f8c74811b7f92c1264c90a2

SHA256
4be70aa77dfb711f3df8cc1f038c6d1d86d5ecdc0487fb0dfaad2c681dc0dca9

SHA512
d9baa86962bb9fb3454e22cbf9c167aebb80c716142e34d5d48e24794be7215ffd452b105b34155a0cb7b70c3a31650549ded2f106bc1eb21646138b0f2aa87d

Download Submit
\??\pipe\crashpad_1436_SVSKCZEFNJQHCNFQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download