df6e584a531d92bccdd05c30e9489287019f7893d0f5051c14ca31f87566386e

Analysis

max time kernel
108s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Anonymous High Orbit Ion Cannon.exe
Size

5.1MB
MD5

bff3f5b6a77ad6077f8bb450db4d0aa1
SHA1

b843c42ea7f3904cbe51e4e3ff83ce7de8f92980
SHA256

df6e584a531d92bccdd05c30e9489287019f7893d0f5051c14ca31f87566386e
SHA512

51dbc39ce5faae2e7f530ea83802a33a3badb755e06185b91fb986d175a603563d68b92753de7e620c38ac519fb82a3fea0b31e3c70653af29000fd7585ec5e5
SSDEEP

49152:dXClsLmEikKIvgp28S6ZBMihDVbD9d5VGopGXLvSAu/cgVJT0xd97j:Ves6RhO29GX7Pd9X

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1692	SKlauncher 3-beta.21.exe
2492	SKlauncher 3-beta.21.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	2008	WerFault.exe	33

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3748	chrome.exe
3748	chrome.exe
2956	chrome.exe
2956	chrome.exe
4428	chrome.exe
4428	chrome.exe
4212	chrome.exe
4212	chrome.exe
1120	chrome.exe
1120	chrome.exe
2884	chrome.exe
2884	chrome.exe
2068	chrome.exe
2068	chrome.exe
4656	chrome.exe
4656	chrome.exe
3036	chrome.exe
3036	chrome.exe
1908	chrome.exe
1908	chrome.exe
1120	chrome.exe
1120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1696	Anonymous High Orbit Ion Cannon.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe
2956	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 488	2956	chrome.exe	92
PID 2956 wrote to memory of 488	2956	chrome.exe	92
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 480	2956	chrome.exe	95
PID 2956 wrote to memory of 3748	2956	chrome.exe	96
PID 2956 wrote to memory of 3748	2956	chrome.exe	96
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97
PID 2956 wrote to memory of 4308	2956	chrome.exe	97

C:\Users\Admin\AppData\Local\Temp\Anonymous High Orbit Ion Cannon.exe
"C:\Users\Admin\AppData\Local\Temp\Anonymous High Orbit Ion Cannon.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 2008 -ip 2008
1⤵
PID:2952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2008 -s 2468
1⤵
- Program crash
PID:912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2f9b4f50,0x7ffe2f9b4f60,0x7ffe2f9b4f70
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1016 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4084
- C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe
  "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
    3⤵
    - Drops file in Program Files directory
    PID:1364
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
    3⤵
    PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:520
- C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe
  "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
  2⤵
  - Executes dropped EXE
  PID:2492
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
    3⤵
    PID:2332
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
    3⤵
    PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,1067133787836481898,16539120294117832020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6156 /prefetch:2
  2⤵
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
1⤵
PID:2160

C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe
"C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
1⤵
PID:4016

C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe
"C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
1⤵
PID:4148
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe"
  2⤵
  PID:3080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
3eb01a6870fa89aac188e0388419b3c9

SHA1
5478a323d1a832ee116bd3a20bd5d9c510013ee9

SHA256
5625ffd5f994a1ed9ac333dc0cc99b6c99ee6c92bed89828499df06e8374cbe3

SHA512
fe55dcd3cd77c60dd9b1278391e20cf64f7a1ea9e3688bbb6697ec6611e1f8cb37cb59bcdeb04dbd3f46338900aeaac064e0f4c669d07968d7bdb7d044a40bed

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\sklauncher_logs.txt

Filesize
47B

MD5
2fd06c5ddf0acb0289a0d8fa880ef934

SHA1
0d0ce02fe6a70806910a9ba0540cacd89d28f214

SHA256
e8310942c8ed8e16e1dd18c59a78f51e90ed2b069dd7f7c4b7b40495639955b0

SHA512
8d45f07cf4a2d3395851f86e40eef694b5b668d2be861bd0285ca938524af928e401a4b41db81097c1f1d9b24b1508527c2392a1a562b47177b84653b0e5dd09

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\sklauncher_logs.txt

Filesize
47B

MD5
2fd06c5ddf0acb0289a0d8fa880ef934

SHA1
0d0ce02fe6a70806910a9ba0540cacd89d28f214

SHA256
e8310942c8ed8e16e1dd18c59a78f51e90ed2b069dd7f7c4b7b40495639955b0

SHA512
8d45f07cf4a2d3395851f86e40eef694b5b668d2be861bd0285ca938524af928e401a4b41db81097c1f1d9b24b1508527c2392a1a562b47177b84653b0e5dd09

Download Submit
C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe

Filesize
358KB

MD5
4e137edecc5f3eeb6ecc3f2ca1c88278

SHA1
882b30957cc5bf736413ab916373230938797371

SHA256
e855bfedbf5aee0ee56b58b59c45c886219c290daf3e23af51126fe1862e613e

SHA512
f021239f571c6aea3f335534e364a93201949c8c63ead6f884434069f4967fe07d818f85794567d5c428cd1022013135d9cdd83fd5b12a9270047e5819beec4d

Download Submit
C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe

Filesize
358KB

MD5
4e137edecc5f3eeb6ecc3f2ca1c88278

SHA1
882b30957cc5bf736413ab916373230938797371

SHA256
e855bfedbf5aee0ee56b58b59c45c886219c290daf3e23af51126fe1862e613e

SHA512
f021239f571c6aea3f335534e364a93201949c8c63ead6f884434069f4967fe07d818f85794567d5c428cd1022013135d9cdd83fd5b12a9270047e5819beec4d

Download Submit
C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe

Filesize
358KB

MD5
4e137edecc5f3eeb6ecc3f2ca1c88278

SHA1
882b30957cc5bf736413ab916373230938797371

SHA256
e855bfedbf5aee0ee56b58b59c45c886219c290daf3e23af51126fe1862e613e

SHA512
f021239f571c6aea3f335534e364a93201949c8c63ead6f884434069f4967fe07d818f85794567d5c428cd1022013135d9cdd83fd5b12a9270047e5819beec4d

Download Submit
C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe

Filesize
358KB

MD5
4e137edecc5f3eeb6ecc3f2ca1c88278

SHA1
882b30957cc5bf736413ab916373230938797371

SHA256
e855bfedbf5aee0ee56b58b59c45c886219c290daf3e23af51126fe1862e613e

SHA512
f021239f571c6aea3f335534e364a93201949c8c63ead6f884434069f4967fe07d818f85794567d5c428cd1022013135d9cdd83fd5b12a9270047e5819beec4d

Download Submit
C:\Users\Admin\Downloads\SKlauncher 3-beta.21.exe

Filesize
358KB

MD5
4e137edecc5f3eeb6ecc3f2ca1c88278

SHA1
882b30957cc5bf736413ab916373230938797371

SHA256
e855bfedbf5aee0ee56b58b59c45c886219c290daf3e23af51126fe1862e613e

SHA512
f021239f571c6aea3f335534e364a93201949c8c63ead6f884434069f4967fe07d818f85794567d5c428cd1022013135d9cdd83fd5b12a9270047e5819beec4d

Download Submit
memory/1132-208-0x00000000028E0000-0x00000000038E0000-memory.dmp

Filesize
16.0MB

Download
memory/1364-176-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1364-170-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1364-159-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1364-190-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1364-142-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1364-152-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1696-132-0x0000000002770000-0x00000000028D0000-memory.dmp

Filesize
1.4MB

Download