bumblebee | 08d93a2201ddb766209a9a6adf88c377a2617a6d963bd408c3dabe92ae8b9b5e

Analysis

max time kernel
207s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Document_2173_Scan_(Nov8).html
Size

1.8MB
MD5

74883888d9279c414e01db7e654306c2
SHA1

a4a22d336b6fdf9adccedf7518a0013d2622e36f
SHA256

08d93a2201ddb766209a9a6adf88c377a2617a6d963bd408c3dabe92ae8b9b5e
SHA512

ae4757db86561c4085ef291e33691a18e6375cbbf100dfd7aeb8533ea937d8c41e0f0a8b7410904ea183e904701edd590416744322b9f2f6ed4e1e68f37ce8de
SSDEEP

24576:F2XNH1C8Q24r4xUL4/tcE9rhEfzA9n3UX7lGFPvvQjouYabAXgBlgbqRWuDLe:M9VCHQWmlojouldBl9RWue

Score

10^/10

bumblebee 0811r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0811r

176.223.165.108:443

146.19.253.28:443

146.70.149.38:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 2 IoCs

flow	pid	Process
191	2436	rundll32.exe
199	2436	rundll32.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2436	rundll32.exe
4276	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404372be8cf3d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3249509914"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000d2e8fe85f90a3fc05401cc0126e971f0c7fb718bc6f595516b0771dab13052ef000000000e80000000020000200000001725504f63559a36ae8ac399f5be3fa25e240e5ebd13de0873b8ae6844368e1820000000a139f9a0281e03379d78607061c58a73ce9cea7af6899ab54f222639b05e4378400000001d52abd71649992bb8d0e40ce71d30bf453b9dc245383923ff5b2242ef30a1f30b756e60a20324cc801a749962671c7b3edcca320fd9e6a2eac948b90a913771	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a100000000002000000000010660000000100002000000034bf2bfc0de48ff14af7f7f59fe5c61b7ec806fb7dfbba1c14924a6393a31e9b000000000e8000000002000020000000aaa7f06771adc09afa41292f7d16b1858f4348547a71c56cfd067ff114c608a620000000b605fdcafac4353fb51eb75ec6b7348e68b3074686ebb541b9092b91b561f1ef400000001619fd8cb2e8c8ad54ffa508f67831c4b917a4d1532b8dad1cd1a7716eb7890b55faca428e54d7fdcda8d7cd4988db130e05c84a1064416a77926ea19a960ca7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60dde2c58cf3d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995340"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995340"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374688808"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3249509914"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DB858606-5F7F-11ED-89AC-F639923F7CA1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4412	chrome.exe
4412	chrome.exe
2276	chrome.exe
2276	chrome.exe
4436	chrome.exe
4436	chrome.exe
560	chrome.exe
560	chrome.exe
4088	chrome.exe
4088	chrome.exe
3028	chrome.exe
3028	chrome.exe
2620	chrome.exe
2620	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe
2172	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2232	iexplore.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
4116	IEXPLORE.EXE
4116	IEXPLORE.EXE
4116	IEXPLORE.EXE
4116	IEXPLORE.EXE
4116	IEXPLORE.EXE
4116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4116	2232	iexplore.exe	81
PID 2232 wrote to memory of 4116	2232	iexplore.exe	81
PID 2232 wrote to memory of 4116	2232	iexplore.exe	81
PID 2276 wrote to memory of 4408	2276	chrome.exe	94
PID 2276 wrote to memory of 4408	2276	chrome.exe	94
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 2760	2276	chrome.exe	95
PID 2276 wrote to memory of 4412	2276	chrome.exe	96
PID 2276 wrote to memory of 4412	2276	chrome.exe	96
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97
PID 2276 wrote to memory of 2676	2276	chrome.exe	97

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Document_2173_Scan_(Nov8).html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa41824f50,0x7ffa41824f60,0x7ffa41824f70
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1540 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1596,2042273790121472454,14427590672591523761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""E:\multifariously\disrating.cmd" "
1⤵
- Enumerates connected drives
PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K multifariously\conscionably.cmd system rundl
  2⤵
  - Enumerates connected drives
  PID:216
- - C:\Windows\system32\replace.exe
    replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:4344
- - C:\Windows\system32\rundll32.exe
    rundll32.exe multifariously\gnostic.jpg,PUpdate
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:2436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""E:\multifariously\disrating.cmd" "
1⤵
- Enumerates connected drives
PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K multifariously\conscionably.cmd system rundl
  2⤵
  - Enumerates connected drives
  PID:4776
- - C:\Windows\system32\replace.exe
    replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:4596
- - C:\Windows\system32\rundll32.exe
    rundll32.exe multifariously\gnostic.jpg,PUpdate
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
7ed55478d555cb8377ac6f26628056d4

SHA1
fa1b8535c06b30914b4c23b185ac89ea9d884b04

SHA256
4a502dd143766bdf1bc0737a0a2e813abf0003579257e0acd299046091a7ba58

SHA512
34f23c0b850bd69d9a171ffe0b85449d8fe1fe7976e7f363d374f867ee4a7d9f610e0ba06fc5138cb016444b7b2e75c62e266e8a75fd9cd2dd37f55752ffaa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_3B0C6F9A5FE4CC35B9E0194525154B89

Filesize
471B

MD5
96791bd486db22c41012d25318835bdf

SHA1
b32c813f16b84a6b2660bd527843da5e368af8eb

SHA256
61a4589c35910af9f8d20ff0c7eca296a77a336ab00730573fe9ce7cf2cc72c5

SHA512
2f5a304602a160dcacbb945fb48b3534093990abe596fbc230f1b4d5f078e485edccbe671b421fb27ceab7da72cfab3ac6344be06bfa8fa0cb5e769fcd35f1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
2cd951bfbc94d7820787af09fa424c00

SHA1
82b42d925289be55f71a4176cdb762a47c8d4323

SHA256
ee02557af9c425e9fc5cf1923e003705fbd0e00e9a91386092bb3ca4bf7c0922

SHA512
181cadc4fd8371299a6a8b49b1c4d8927555af2ea228d91eb0e5b27c60b96e9d4392be2ea0444f67c9d75ed36fee2ee4bbc92bcb3c472e694d49cea90a739a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
a67f3a572091e82304304256d46b224d

SHA1
ba981ed0d0596663a8685cd6c2b2431b20d80831

SHA256
772ba61ee970f5ddb793de49b01e6a1062ccd72433438da83e59c43f162ecc3a

SHA512
5cafdcca04942caccf2bc6fb43be7e31ec038ab9ea285123f77668cf0bd393ff0e6859b4c168bb2460e9be483f3b7ad3193cf014beda4b57df9246d0285e33be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_3B0C6F9A5FE4CC35B9E0194525154B89

Filesize
406B

MD5
ab1416caab6a6c05859d4051cb92d232

SHA1
89409f5639cb012393e8fe3eefd9fc13f1b72f8a

SHA256
b0a0bf6d9d7b86a42acab64d8b2ae100b7de8c8152141fb9c6b971a913059e6b

SHA512
02e32e755d34cd6334cda259cda8f9fdd09acc5dcb8e4953c869960e2b0cf3d62feabc33aea54ae57f0620d5781856426ca516dc74c0649add0ec569ecf28ab5

Download Submit
memory/2436-143-0x0000029938A10000-0x0000029938B59000-memory.dmp

Filesize
1.3MB

Download
memory/2436-144-0x00000299386F0000-0x0000029938766000-memory.dmp

Filesize
472KB

Download
memory/4276-148-0x0000017E504E0000-0x0000017E50629000-memory.dmp

Filesize
1.3MB

Download
memory/4276-149-0x0000017E50320000-0x0000017E50396000-memory.dmp

Filesize
472KB

Download