Analysis
-
max time kernel
589s -
max time network
600s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
15-12-2022 04:31
Static task
static1
Behavioral task
behavioral1
Sample
Document_45_Dec1.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Document_45_Dec1.html
Resource
win10v2004-20221111-en
General
-
Target
Document_45_Dec1.html
-
Size
221KB
-
MD5
6c130bf0bf8c70d5fd04418d005aabf1
-
SHA1
9e5d2b15c11fd7d01de0cf5820c1d701b58a4704
-
SHA256
a2948b43f53a5cb46d59e85563528d4b33015170453ad1648b0578a9ce5b913e
-
SHA512
0135e266ce4a3bafd30f99bc0117a51d538e4b92c4f5624b2eef4e7fb55148232ee0ff3a2b56fbe2d2cd582713344da03c615d58f567faa710d1a9ca33ba3bb4
-
SSDEEP
6144:V1oT3/qcQLScAEsZieCSt4Sem3N/DkSf3Yx1VJSxt+ooYu7k:VwPjQWcRsB4oAK3Yx3JSxcYb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ChromeRecovery.exepid process 2032 ChromeRecovery.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\manifest.json elevation_service.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b9a28c4610d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000c926e638b617582b38dd0db2151f423865e34ede4005b3e1d9df62f225f863f9000000000e80000000020000200000003dac160758719482740bd10da3a3af3a2d1652ab5878c47fa4c84633220a533190000000f4f00ccaf4276af5a770d9ff0135eeda01a1dd351f259662b374dbfe8dc14fe6e16124edf7069d9fa897860bc190165c6324b26f99fc3af337708919f3b479224a0801f9c07c4b657e3d92610936f7bf58cb45ebd680a86504c951ff78c2ab7b3881b89dc3047d882661591a9628955ca8692064b2c7fbf110f69f35885b3f3152cceafddb261e2608ed712938f17761400000005b3c168dbdc4fcad6e128d49026a1f89ffde6db59de422656cd0a326c84f08a4d6fe8ec4e8c7dbe727e8d4a9a92b0f1bfd19434f76032924d999590de9421012 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377847259" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6FEB7C1-7C39-11ED-AD3F-4EFAD8A2B6A5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000055641dbc129e8b8575c59fa39c87a84bc2e588d191b592327411f258efb0eaf5000000000e80000000020000200000006a2cb38fc0129a67ab7279f3e4627b9c57ec680b81256be899a7bdd7bdd48a3520000000ed6d954d52ad3a211bbb9de686819219d9f1a19254f261f7cecc147eb364ea4b40000000d1684f6d3129dd9177ce90badaafb852c545de5cfbdd24dca3bdea1436c00121adff80a4883d8b5d52ad5a548dcbd391cd0e7a19e3ac5d361362a076bfaf1332 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exepid process 2020 chrome.exe 1924 chrome.exe 1924 chrome.exe 2832 chrome.exe 2192 chrome.exe 1924 chrome.exe 1924 chrome.exe 960 chrome.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
Processes:
iexplore.exechrome.exepid process 1724 iexplore.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1724 iexplore.exe 1724 iexplore.exe 268 IEXPLORE.EXE 268 IEXPLORE.EXE 268 IEXPLORE.EXE 268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 1724 wrote to memory of 268 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 268 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 268 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 268 1724 iexplore.exe IEXPLORE.EXE PID 1924 wrote to memory of 428 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 428 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 428 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1584 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 2020 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 2020 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 2020 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1984 1924 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Document_45_Dec1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ee4f50,0x7fef6ee4f60,0x7fef6ee4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1748 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3296 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1136 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,4624274031495279840,13368324761804101149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 /prefetch:82⤵
-
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_attachment.zip\IRS_Form_12-01-43.iso"1⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={177ade4c-7494-4e3d-aeda-a21e92f375f2} --system2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1832_810260374\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9UK32GS9.txtFilesize
608B
MD5844b779cbbf9b2295a955e1f56fa5d32
SHA1825d3c3f680c5e77f3b4cdd6bd5a904afa5bdf13
SHA256fcec12b356ad757ea8d80b01548cdfddd5ce9f89f749f9e3ac3969e5cae132e8
SHA51239f76c216d5c6aa123a9b5e92980de0342f7f4eabef6781cab1a8675ba9c1ba4b181c662fec86c1af136fa36ddcc32444a029d924296dcf00effa090c8ad2120
-
\??\pipe\crashpad_1924_WMCGHIEPBLGDEMKBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2032-58-0x0000000000000000-mapping.dmp
-
memory/2032-60-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/2988-56-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmpFilesize
8KB