89bc05a18db73de6b19390bc0ef32711e4e357ebb89a9aa915c5d2d15da3a33c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.9MB
Sample221102-zd5m2abfc7
SHA256 89bc05a18db73de6b19390bc0ef32711e4e357ebb89a9aa915c5d2d15da3a33c
MD5 99fa3cf292e4c3534951b6ebd96a6802
SHA1 0d413e37db1be727beda18a33295c5105987f4bf
SHA512 b7382fe0cea6b2f22c224d8951c83aac703de50dca7d4fd03c802cc76652a9f3eccb0eee7684be39d743daa420d2176ea6e91c5dd5de852ff73fae26df859eda
SSDEEP 98304:8yj8MwA8xw0RziBr7PNQoPojPbiPB/Nxt/QTt9KrrY7Pj3UV7B9IzHRYO4yxhN0L:B80f9Pp+D6Twgr9Vt98d4yxj+xMtE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2856	netsh.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3912-134-0x0000000000E00000-0x0000000001577000-memory.dmp	upx
behavioral2/memory/3912-139-0x0000000000E00000-0x0000000001577000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
856	chrome.exe
856	chrome.exe
3060	chrome.exe
3060	chrome.exe
4200	chrome.exe
4200	chrome.exe
1652	chrome.exe
1652	chrome.exe
1360	chrome.exe
1360	chrome.exe
4808	chrome.exe
4808	chrome.exe
428	chrome.exe
428	chrome.exe
856	chrome.exe
856	chrome.exe
4344	chrome.exe
4344	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
1588	chrome.exe
3700	chrome.exe
3700	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe
856	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
856	chrome.exe
856	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3248	3912	file.exe	83
PID 3912 wrote to memory of 3248	3912	file.exe	83
PID 3248 wrote to memory of 2856	3248	cmd.exe	84
PID 3248 wrote to memory of 2856	3248	cmd.exe	84
PID 3912 wrote to memory of 856	3912	file.exe	85
PID 3912 wrote to memory of 856	3912	file.exe	85
PID 856 wrote to memory of 384	856	chrome.exe	86
PID 856 wrote to memory of 384	856	chrome.exe	86
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 1748	856	chrome.exe	89
PID 856 wrote to memory of 3260	856	chrome.exe	90
PID 856 wrote to memory of 3260	856	chrome.exe	90
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92
PID 856 wrote to memory of 3716	856	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\system32\cmd.exe
  cmd.exe /c "NetSh Advfirewall set allprofiles state off"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\netsh.exe
    NetSh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://example.com --load-extension=C:\Users\Admin\AppData\Local\extenttfxt --user-data-dir=C:\Users\Admin\AppData\Local\usrdat-VyKLF --no-first-run=true --disable-default-apps --no-default-browser-check=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\usrdat-VyKLF /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\usrdat-VyKLF\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\usrdat-VyKLF --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffdf6324f50,0x7ffdf6324f60,0x7ffdf6324f70
    3⤵
    PID:384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:2
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=2032 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=2332 /prefetch:8
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=3916 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=4336 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=4640 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=1080 /prefetch:8
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=4368 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=2868 /prefetch:8
    3⤵
    PID:1992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=3992 /prefetch:8
    3⤵
    PID:2152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3992 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    PID:1964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,2813664317779061635,7699383855180526405,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\usrdat-VyKLF" --mojo-platform-channel-handle=3972 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.js

Path C:\Users\Admin\AppData\Local\extenttfxt\background.js
Size 1KB
SHA256 878fcdbf34efb1eafb843fdcd9ed140ea3f617adffb8ff505eea96c28a9f4db9
MD5 74a9c69d4ce48d0438b60ba62b4a2c35
SHA1 a84a79817410233cff8d44058eb9e77adce344fd
SHA512 c49d70f0c0f244dcfad342bf4a70cbd2b01d4045ff5bc7ec3265f9958b04dad6855be7489e745c25efdad6667d1d860a0fa4d6cadc3b9588ed3bd9419b1fed25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\extenttfxt\manifest.json
Size 231B
SHA256 c05ec956376eb913f7b7ed3f3cdfb27704422a535000462ad0cb1ca0fc70aa6f
MD5 cef055c7efb02b871df01aa4702ca772
SHA1 861e2fef078ea737ded75b4da6f5714a132f95d5
SHA512 0948c6e882a406ef643614ecc74489b7964854f53d5b614ef175c69c1d23634f9c6113c3027654746b223c83145f9fde81729bc62038149271d4025a29ee7a13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\usrdat-VyKLF\Crashpad\settings.dat
Size 40B
SHA256 ec417d3786f95c872d1b9caa62bbb1156fba8bc854d5e7c07afe671b95fbe48f
MD5 51fb5fadce4ead52d2616f7dadff686f
SHA1 b0c0b38a08f44193838cb916148e4dbdaaddd15c
SHA512 c278a3fb9616560faa8a095f663693724cba56a2ea3e0fa972e99a5154300ce187efa0b29d23460486902fce53341a22e80ee80f03e4c113e59a197990287e54
MD5 SHA1 SHA512

Submit Download

memory/3912-134-0x0000000000E00000-0x0000000001577000-memory.dmp

Download

memory/3912-139-0x0000000000E00000-0x0000000001577000-memory.dmp

Download