Analysis
-
max time kernel
103s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:41
Static task
static1
Behavioral task
behavioral1
Sample
browser.exe
Resource
win10v2004-20221111-en
General
-
Target
browser.exe
-
Size
89KB
-
MD5
6bea7d0314e1e86f1e284f4be64ee0d3
-
SHA1
e20bde0a5a8bce416128133681532191e3258efb
-
SHA256
d4814a895aa5e8cc7ef2751eb7b378995ec929a441056c25e54ae87522f8ac20
-
SHA512
a1f42d06c0b1a46892565e83229d946f106fe5353f4172efb6751416bdf2c861470d72d35e90773a4a44ba7805fe159e91bf019a3d8fd167b80e90cc814c9a1c
-
SSDEEP
1536:D7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfcwgnOl:f7DhdC6kzWypvaQ0FxyNTBfcLu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exechrome.exechrome.exepid process 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2308 chrome.exe 2308 chrome.exe 4840 chrome.exe 4840 chrome.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2576 taskmgr.exe Token: SeSystemProfilePrivilege 2576 taskmgr.exe Token: SeCreateGlobalPrivilege 2576 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 2104 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
browser.execmd.exefirefox.exechrome.exemsedge.exechrome.exemsedge.exefirefox.exefirefox.exedescription pid process target process PID 4532 wrote to memory of 2776 4532 browser.exe cmd.exe PID 4532 wrote to memory of 2776 4532 browser.exe cmd.exe PID 2776 wrote to memory of 4048 2776 cmd.exe chrome.exe PID 2776 wrote to memory of 4048 2776 cmd.exe chrome.exe PID 2776 wrote to memory of 224 2776 cmd.exe firefox.exe PID 2776 wrote to memory of 224 2776 cmd.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 224 wrote to memory of 2104 224 firefox.exe firefox.exe PID 2776 wrote to memory of 3116 2776 cmd.exe msedge.exe PID 2776 wrote to memory of 3116 2776 cmd.exe msedge.exe PID 4048 wrote to memory of 4152 4048 chrome.exe chrome.exe PID 4048 wrote to memory of 4152 4048 chrome.exe chrome.exe PID 3116 wrote to memory of 1000 3116 msedge.exe msedge.exe PID 3116 wrote to memory of 1000 3116 msedge.exe msedge.exe PID 2776 wrote to memory of 1316 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 1316 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4624 2776 cmd.exe chrome.exe PID 2776 wrote to memory of 4624 2776 cmd.exe chrome.exe PID 2776 wrote to memory of 2952 2776 cmd.exe firefox.exe PID 2776 wrote to memory of 2952 2776 cmd.exe firefox.exe PID 2776 wrote to memory of 764 2776 cmd.exe msedge.exe PID 2776 wrote to memory of 764 2776 cmd.exe msedge.exe PID 4624 wrote to memory of 3632 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 3632 4624 chrome.exe chrome.exe PID 764 wrote to memory of 3984 764 msedge.exe msedge.exe PID 764 wrote to memory of 3984 764 msedge.exe msedge.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2952 wrote to memory of 736 2952 firefox.exe firefox.exe PID 2104 wrote to memory of 1492 2104 firefox.exe firefox.exe PID 2104 wrote to memory of 1492 2104 firefox.exe firefox.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4048 wrote to memory of 944 4048 chrome.exe chrome.exe PID 4048 wrote to memory of 944 4048 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe PID 4624 wrote to memory of 4464 4624 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\browser.exe"C:\Users\Admin\AppData\Local\Temp\browser.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BFCA.tmp\BFCB.tmp\BFCC.bat C:\Users\Admin\AppData\Local\Temp\browser.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab9b64f50,0x7ffab9b64f60,0x7ffab9b64f704⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1996 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,5312015722160458453,15336116208694002797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:84⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window pornhub.com/gay?search=femboy4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.0.761477069\752944317" -parentBuildID 20200403170909 -prefsHandle 1736 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1796 gpu5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.3.555279196\1795066401" -childID 1 -isForBrowser -prefsHandle 2596 -prefMapHandle 2472 -prefsLen 78 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2580 tab5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffac9c746f8,0x7ffac9c74708,0x7ffac9c747184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11002449593453583921,12142642025582286217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11002449593453583921,12142642025582286217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:34⤵
-
C:\Windows\system32\cmd.execmd.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab9b64f50,0x7ffab9b64f60,0x7ffab9b64f704⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1940 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,17049087685794759729,12357464242839023326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2340 /prefetch:84⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --new-window pornhub.com/gay?search=femboy4⤵
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "pornhub.com/gay?search=femboy"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffac9c746f8,0x7ffac9c74708,0x7ffac9c747184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4648582800837183280,8208860581508375882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4648582800837183280,8208860581508375882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:34⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5709abe60edd890aec38f0de2343a5555
SHA1d345fca81f82a2b38a1398aa8ec70ff8b25bede3
SHA2561b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c
SHA512ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5709abe60edd890aec38f0de2343a5555
SHA1d345fca81f82a2b38a1398aa8ec70ff8b25bede3
SHA2561b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c
SHA512ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5709abe60edd890aec38f0de2343a5555
SHA1d345fca81f82a2b38a1398aa8ec70ff8b25bede3
SHA2561b2a19aecb8e0405a1a1b108a895473188621fb0733d2f1b924f95475d3d442c
SHA512ed7a4800945492d73f44ec50353dd68625a4027433b8b4482c6e10110e0d2adb79bce1e74747d74305c32204385191b409c2c5d718e2d383b370e0f7e29dd200
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountFilesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOGFilesize
345B
MD5a0339eafebdffe8a46ce3359ec82dddb
SHA131a396410f36206f4530b67230d00c73e7dfe6dd
SHA25667f7848c26c27943b42d004c2d114a762b74442f77c4e4935ec3d461c9c30aef
SHA512a3bf54248e0d4ca16936a9c7254e565a6345e0e25380c43a28771be5fd9d27f0d73985681fa4b47e1e645d57caabce2bcb587f1c132eabcd88d91efaf65293ac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOGFilesize
321B
MD55e122563e9db8ab726509d89b394f67b
SHA1b0c4650bf160fc7b2b0ba77deb21373a118a4c55
SHA256b03697a4f0f5fc93e103020bd49a2ce7a94a46ac6a69d56784673c522dbaaaaa
SHA5123d7f0f0dc07525163ab9d503228724cdd295164248f74f2567cb5fc9497740bc696000ed8da54374564ee6b9d5d3c82b3e0e3dd87a92773dc6b8173ff7a7045c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last VersionFilesize
13B
MD5b63048c4e7e52c52053d25da30d9c5ab
SHA1679a44d402f5ec24605719e06459f5a707989187
SHA256389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1
SHA512e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d492567d4611438b2f936ddcaa9544ef
SHA1ae88af380bbeb5e05a0446163a5434d70710f853
SHA2560cba2ccfcfff09f076de767bf8df52485a8ac4b29cd3d14d53b23fdad2da3645
SHA512150794b8598594ac00f827996e62d84b9331f1e35386e908485181204e823e8e5802fa543b53aca4d3046d176eaf4ee1dcb4df211589ea2fedac46170f162f48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d492567d4611438b2f936ddcaa9544ef
SHA1ae88af380bbeb5e05a0446163a5434d70710f853
SHA2560cba2ccfcfff09f076de767bf8df52485a8ac4b29cd3d14d53b23fdad2da3645
SHA512150794b8598594ac00f827996e62d84b9331f1e35386e908485181204e823e8e5802fa543b53aca4d3046d176eaf4ee1dcb4df211589ea2fedac46170f162f48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD518ad3a99cbd5ddc6b806e98374137f92
SHA103b6e4402a81fc0585430539a6d4a208b6ca9020
SHA256b4f8afdb8ec7975ab4f4bff3a5c1fcab389dee2b9eb38b9603099d500457145f
SHA512faabf3e957ee6516f8e66a1decfb2279e3923f63d0bc3f4f6aa5082b84feba57e48d0c631800b962567313b26d6cb92192a29eef6faf7b0be01894233b4929b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
C:\Users\Admin\AppData\Local\Temp\BFCA.tmp\BFCB.tmp\BFCC.batFilesize
286B
MD5d2146f3845c3127a8f1d235e8df66493
SHA15f8132fae859671e4676f584561aab3acd751fc4
SHA256d3ef7607cc2efbc6a51fe165e89560517cf8b9a72f3d50821263c317348a8d88
SHA512619c00b4fabcc28a45af70f4b9557c745ebb8cfb4ea9e1a6f36a04701a5d84dddf452c77fd256bc13dd7ee5de1d9877b1d666afd0995a74dcd990d9ae21dfeec
-
\??\pipe\LOCAL\crashpad_3116_HFKEDHJBXKENLTIKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_764_PELFZOHOTTVPHNXHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_4048_RENSGDIGNJGMVIRTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_4624_VYXQULDIABWGOYDWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/764-137-0x0000000000000000-mapping.dmp
-
memory/1000-135-0x0000000000000000-mapping.dmp
-
memory/1316-136-0x0000000000000000-mapping.dmp
-
memory/2596-151-0x0000000000000000-mapping.dmp
-
memory/2776-132-0x0000000000000000-mapping.dmp
-
memory/3116-134-0x0000000000000000-mapping.dmp
-
memory/3132-150-0x0000000000000000-mapping.dmp
-
memory/3984-138-0x0000000000000000-mapping.dmp
-
memory/5404-152-0x0000000000000000-mapping.dmp
-
memory/5508-153-0x0000000000000000-mapping.dmp