Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1418s -
max time network
1225s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 05:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dl.malwarewatch.org/software/useful/TotalCommander.zip
Resource
win10v2004-20221111-en
General
-
Target
https://dl.malwarewatch.org/software/useful/TotalCommander.zip
Malware Config
Extracted
\??\c:\totalcmd\HISTORY.TXT
https
https://www.7-zip.org/sdk.html
https://msdn.microsoft.com/en-us/library/windows/desktop/dd378457.aspx
http-equiv="Content-Type">
http
https/ftps
http://bugs.freepascal.org/view.php?id=17280
http-equiv="Content-type"
http://www.hardtoc.com/archives/198
http://msdn.microsoft.com/en-us/library/dd318693%28VS.85%29.aspx
http://www.ghisler.com/strace.zip
http://buglist.jrsoftware.org/generated/entry0686.htm
http://anso.da.ru
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3916 ChromeRecovery.exe 1820 TOTALCMD64.EXE 3872 TOTALCMD64.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TOTALCMD64.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TOTALCMD64.EXE -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: TOTALCMD64.EXE File opened (read-only) \??\a: TOTALCMD64.EXE File opened (read-only) \??\f: TOTALCMD64.EXE File opened (read-only) \??\s: TOTALCMD64.EXE File opened (read-only) \??\v: TOTALCMD64.EXE File opened (read-only) \??\o: TOTALCMD64.EXE File opened (read-only) \??\s: TOTALCMD64.EXE File opened (read-only) \??\m: TOTALCMD64.EXE File opened (read-only) \??\n: TOTALCMD64.EXE File opened (read-only) \??\a: TOTALCMD64.EXE File opened (read-only) \??\h: TOTALCMD64.EXE File opened (read-only) \??\r: TOTALCMD64.EXE File opened (read-only) \??\t: TOTALCMD64.EXE File opened (read-only) \??\h: TOTALCMD64.EXE File opened (read-only) \??\e: TOTALCMD64.EXE File opened (read-only) \??\i: TOTALCMD64.EXE File opened (read-only) \??\l: TOTALCMD64.EXE File opened (read-only) \??\n: TOTALCMD64.EXE File opened (read-only) \??\q: TOTALCMD64.EXE File opened (read-only) \??\w: TOTALCMD64.EXE File opened (read-only) \??\k: TOTALCMD64.EXE File opened (read-only) \??\p: TOTALCMD64.EXE File opened (read-only) \??\t: TOTALCMD64.EXE File opened (read-only) \??\u: TOTALCMD64.EXE File opened (read-only) \??\f: TOTALCMD64.EXE File opened (read-only) \??\x: TOTALCMD64.EXE File opened (read-only) \??\b: TOTALCMD64.EXE File opened (read-only) \??\j: TOTALCMD64.EXE File opened (read-only) \??\o: TOTALCMD64.EXE File opened (read-only) \??\r: TOTALCMD64.EXE File opened (read-only) \??\x: TOTALCMD64.EXE File opened (read-only) \??\g: TOTALCMD64.EXE File opened (read-only) \??\q: TOTALCMD64.EXE File opened (read-only) \??\w: TOTALCMD64.EXE File opened (read-only) \??\m: TOTALCMD64.EXE File opened (read-only) \??\p: TOTALCMD64.EXE File opened (read-only) \??\b: TOTALCMD64.EXE File opened (read-only) \??\g: TOTALCMD64.EXE File opened (read-only) \??\j: TOTALCMD64.EXE File opened (read-only) \??\e: TOTALCMD64.EXE File opened (read-only) \??\i: TOTALCMD64.EXE File opened (read-only) \??\l: TOTALCMD64.EXE File opened (read-only) \??\y: TOTALCMD64.EXE File opened (read-only) \??\z: TOTALCMD64.EXE File opened (read-only) \??\y: TOTALCMD64.EXE File opened (read-only) \??\k: TOTALCMD64.EXE File opened (read-only) \??\u: TOTALCMD64.EXE File opened (read-only) \??\v: TOTALCMD64.EXE -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\_metadata\verified_contents.json elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 100 chrome.exe 100 chrome.exe 3692 chrome.exe 3692 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1240 chrome.exe 1240 chrome.exe 3712 chrome.exe 3712 chrome.exe 2292 chrome.exe 2292 chrome.exe 1556 Total Commander.exe 1556 Total Commander.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 100 chrome.exe 100 chrome.exe 100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1556 Total Commander.exe Token: SeDebugPrivilege 1556 Total Commander.exe Token: SeDebugPrivilege 1556 Total Commander.exe Token: SeDebugPrivilege 1556 Total Commander.exe Token: SeDebugPrivilege 1556 Total Commander.exe Token: SeDebugPrivilege 1556 Total Commander.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 1556 Total Commander.exe 1820 TOTALCMD64.EXE 3872 TOTALCMD64.EXE -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe 100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 100 wrote to memory of 4428 100 chrome.exe 84 PID 100 wrote to memory of 4428 100 chrome.exe 84 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4600 100 chrome.exe 87 PID 100 wrote to memory of 4524 100 chrome.exe 88 PID 100 wrote to memory of 4524 100 chrome.exe 88 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89 PID 100 wrote to memory of 1884 100 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://dl.malwarewatch.org/software/useful/TotalCommander.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850d74f50,0x7ff850d74f60,0x7ff850d74f702⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1584 /prefetch:22⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:82⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:12⤵PID:1192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:82⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:82⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4404 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=892 /prefetch:82⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:82⤵PID:4016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:82⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:12⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:82⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,4945965473428760134,15209574331205474466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:82⤵PID:1140
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2188
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:1444 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1444_2003180648\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={9d60985d-e139-4714-bb71-6c3edc5ffef5} --system2⤵
- Executes dropped EXE
PID:3916
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1796
-
C:\Users\Admin\Downloads\TotalCommander\Total Commander.exe"C:\Users\Admin\Downloads\TotalCommander\Total Commander.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556
-
C:\totalcmd\TOTALCMD64.EXE"C:\totalcmd\TOTALCMD64.EXE"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1820
-
C:\totalcmd\TOTALCMD64.EXE"C:\totalcmd\TOTALCMD64.EXE"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
Filesize
41B
MD5926eb45a00d3c2c4afef6ce8ac07691b
SHA12ec963e72f8268b08dfb24e9071e10017d0f28d5
SHA256bf16fb4bac9923e4327e3dd4f8398f0996b7395509123830f52a9b6ef66e3467
SHA512dce58e3b553143be5613a49748ebb0b479dcf3d21f156cefce6614bc66e1bc4c9273c02454f8bb28b3da5cd9333474091f65c374564d80cb4212561f903c86e3
-
Filesize
595B
MD5206889e79a0d30c049d56c0e72761e78
SHA16600623329334f3c3ffbee4f7cbfa2a82ef47e65
SHA25699bc826eff7aa2f43ed65180e3aa32fd9dab59889f9895876bc93197f548674f
SHA512e6e51e20162eeb0ac7b43efa6a47fe24daea2ab9f6960530da629325f5365d13b05f702635b955fdb52afb9afca1647d3987d5233541627f3b0bb54ba28236f3
-
Filesize
8.5MB
MD55651e23e63ba23821c2ac8cd38d54593
SHA15f731e30733ef0371dc3a82240c918da73cfc041
SHA256600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef
SHA512c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8
-
Filesize
8.5MB
MD55651e23e63ba23821c2ac8cd38d54593
SHA15f731e30733ef0371dc3a82240c918da73cfc041
SHA256600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef
SHA512c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8
-
Filesize
8.5MB
MD55651e23e63ba23821c2ac8cd38d54593
SHA15f731e30733ef0371dc3a82240c918da73cfc041
SHA256600d3bf7766ef846db0b8c17971fc5c77d5b37f7b3ae77220e20e752624ef4ef
SHA512c5a8c18fdaa954bbd9831f3d71b65fcd3a43314f1727a8d9376da7a4babfcaa2391e568f3dfa474617161fd4ed655e407921b02ff7c59d42051fe8043080eae8
-
Filesize
977B
MD5f103b23c658d801d5c31cb056bafdc16
SHA18de136fc1dd6372b4eb357304c73eb55393bba13
SHA2568159c946398eec59d8065342c06b957ae38165e664850fb57f5d9971cffb7c21
SHA512a4edb8541eea5fcb6411c59ee604304324aea37e7d0cfc271faf0f8bd044f93282d14c54168e355f59ccd81ad679c2f3cf4cd65dc5b22c6ed4ce6f160beb1cd3
-
Filesize
20KB
MD53a6b27edadab326bbe5d47e0eb6dcaae
SHA16dcbd84131375612b13503e3b65e17f04bceb0ef
SHA2566842ab1e7e498e3eb015e92acdf09daf95b480d48f6f3b5f3256dfb277690ed6
SHA512062c6aaccba2dec42da3c1e89011aae25a16b2a1e28c2518fd38bf64e2a8d682761006e6e085d3f34a6d3500841cb347586699f9e1c1fb9eb3dd2ee3cda7bb99
-
Filesize
25KB
MD5aa0c7c1d4a453a5f1088db0fb10cc91f
SHA12754f5e269ff285268b7b819cd67ef8861ec8e6e
SHA25642bbe67581a6cba05a39dd0e843e4443e0883c69530b889d7e47941c7fd3923b
SHA5123ff79a5f5c3d340ce22b34bf22867d5feedd0aba6757815c410cffaf00cfdfe64921cc645fac2f46ebf5a2546d6f00a1e955cd4d0067bd92e8ac75b46802247c
-
Filesize
417B
MD5359a5959600405bafe7f527698403fd5
SHA14024b741ec3a894123436c20d92e742d2c5549e8
SHA2562269161181abceb488f93ed7a52e81900d3217d0da4cd3fe7cd405b7658d814a
SHA51204af487a7c3a680effdad2ac34881312863a8c1fd5f02d651440a749672972e081b63bc715f0048639618c323377295201195c2b893f5748fe936568282f8ac6
-
Filesize
6KB
MD5708da336eca1f69565cb10092e6b654f
SHA14e7b674dd94e69b9d6dc2d9f703f68363b22fbe0
SHA2565b838143eb9ebd92177e583fd6e247730c06606fe75cbe93751b51e33b1c3495
SHA51286748c8eb868ecb7f0a66c5762574a19c8f8ac82f8502d547dfdb4533ec2127779ebad3256f1a289aeb2b1f6d6d8e88a334998995d01426ca554a6a839041c32
-
Filesize
1.5MB
MD5a62b33507ef138e251e1a530d91824ee
SHA1faa7ca809e4b5915c1918b1864394eb7a5791ca6
SHA2564e8c92b0bf809b3c9d54ab3ce8820ecb70f394ebc7e2e9089d1ca8d862201725
SHA512636db3687815999e2177f34f8defb60a1a331fac398fa26f68c7f2fc65c9d8107f2efeed3875a7ca55950cb4a23b541b288b2f452ce40beea3fda4f61d6c209c
-
Filesize
624KB
MD5326060071ef65a79744d1b813f244a05
SHA14748a79ce0a930ed575b3503fde4871b53103bc2
SHA256c7927522743294ca3193dba7afb3786ba423e18230db640084b24aaf21554c6f
SHA512b3b1ed8c5027b362d9e923325b5af1b8e8c773e0012f77cf19e933e796187cfc7b3c4a95a71ba7e94c18b1b0244bfce712e319328022699b44afd56e51dab03f
-
Filesize
1KB
MD5ee007fe2c0767d99ea41dc14053cb087
SHA1df9dc7bf96408b20bc426466f25c5d4979793f7a
SHA256a2aa6a6a622331ef483d7cf144b3e676a4699fdcdfb101b4ff3c6a7ef294d437
SHA51253c8d972dcd2b8c4e08e2b89adaa8f969ae4d79ee97acf47fc8f625fecb632fa3db0369b63db6bb47103601f960030dd9211f00c1e064e82f4c814268ffae43a