Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2022 19:15
Static task
static1
Behavioral task
behavioral1
Sample
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe
Resource
win10v2004-20220812-en
General
-
Target
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe
-
Size
214KB
-
MD5
0563da06ee50ba49db438972b21d7813
-
SHA1
f7be7fdf9e376ed8b246e3ebd4be2537075eac8c
-
SHA256
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7
-
SHA512
66985e980cdbbdba5f798460a8a3c32e489aabbcfbb74f54bcbef003577eb53c06da39ccc3e7925dc7cae2559721375617a153ab365d55e39a8ca205297f6728
-
SSDEEP
3072:dfh/JULEP8RbdQoKfdes/jUsizN3aA82ms8/g3xoy+ewoODPmG3ERWR3Le:dhxULElfw4jwlaAJAg3CPeVaPnU0V6
Malware Config
Extracted
danabot
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
type
loader
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/960-133-0x00000000004A0000-0x00000000004A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
494D.exeOrwtaofpwtre.exe7D3F.exepid process 628 494D.exe 220 Orwtaofpwtre.exe 1032 7D3F.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
494D.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 494D.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
chrome.exepid process 2576 1332 chrome.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
494D.exedescription pid process target process PID 628 set thread context of 3484 628 494D.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1892 1332 WerFault.exe chrome.exe 3528 1032 WerFault.exe 7D3F.exe 4328 628 WerFault.exe 494D.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe -
Checks processor information in registry 2 TTPs 44 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
494D.exerundll32.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 494D.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 494D.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 494D.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 494D.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 494D.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 494D.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 494D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -
Modifies registry class 19 IoCs
Processes:
rundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 2576 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exepid process 960 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe 960 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
7D3F.exepid process 2576 1032 7D3F.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exepid process 960 9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
Orwtaofpwtre.exedescription pid process Token: SeDebugPrivilege 220 Orwtaofpwtre.exe Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeDebugPrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Orwtaofpwtre.exerundll32.exechrome.exepid process 220 Orwtaofpwtre.exe 3484 rundll32.exe 1332 chrome.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orwtaofpwtre.exepid process 220 Orwtaofpwtre.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
chrome.exepid process 1332 chrome.exe 2576 2576 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
494D.exechrome.exedescription pid process target process PID 2576 wrote to memory of 628 2576 494D.exe PID 2576 wrote to memory of 628 2576 494D.exe PID 2576 wrote to memory of 628 2576 494D.exe PID 628 wrote to memory of 220 628 494D.exe Orwtaofpwtre.exe PID 628 wrote to memory of 220 628 494D.exe Orwtaofpwtre.exe PID 628 wrote to memory of 220 628 494D.exe Orwtaofpwtre.exe PID 2576 wrote to memory of 1332 2576 chrome.exe PID 2576 wrote to memory of 1332 2576 chrome.exe PID 1332 wrote to memory of 1900 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1900 1332 chrome.exe chrome.exe PID 628 wrote to memory of 3484 628 494D.exe rundll32.exe PID 628 wrote to memory of 3484 628 494D.exe rundll32.exe PID 628 wrote to memory of 3484 628 494D.exe rundll32.exe PID 628 wrote to memory of 3484 628 494D.exe rundll32.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1288 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 2620 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 2620 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe PID 1332 wrote to memory of 1960 1332 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe"C:\Users\Admin\AppData\Local\Temp\9b1431ed3a3ac2e55ef652301d7cd58fac4fb7213919f1a180b8cce23c0dc4c7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:960
-
C:\Users\Admin\AppData\Local\Temp\494D.exeC:\Users\Admin\AppData\Local\Temp\494D.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:220 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 14202⤵
- Program crash
PID:4328
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff858394f50,0x7ff858394f60,0x7ff858394f702⤵PID:1900
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,6171738230814039498,118225925356473775,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:22⤵PID:1288
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,6171738230814039498,118225925356473775,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1872 /prefetch:82⤵PID:2620
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1660,6171738230814039498,118225925356473775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:1960
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,6171738230814039498,118225925356473775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:82⤵PID:2864
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1332 -s 36642⤵
- Program crash
PID:1892
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5016
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 448 -p 1332 -ip 13321⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\7D3F.exeC:\Users\Admin\AppData\Local\Temp\7D3F.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2722⤵
- Program crash
PID:3528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1032 -ip 10321⤵PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 628 -ip 6281⤵PID:4808
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\494D.exeFilesize
4.2MB
MD5cc4b391886bf4238e70772704b2c97ca
SHA1aa0cf46c73caac0019a6f5e7f172f4540d33d525
SHA2560290bb1ffcb644899aeb89c8aafdf2dba92aae13b251738163d2d16087f32c4d
SHA512379148eaef2495c9518dfb98fc1c1924e310270e4c9965d42b80fd97531fbccafbec04c3fa67d7cec29140a83e37667426092ac6b60b95313cfccaa626df9072
-
C:\Users\Admin\AppData\Local\Temp\494D.exeFilesize
4.2MB
MD5cc4b391886bf4238e70772704b2c97ca
SHA1aa0cf46c73caac0019a6f5e7f172f4540d33d525
SHA2560290bb1ffcb644899aeb89c8aafdf2dba92aae13b251738163d2d16087f32c4d
SHA512379148eaef2495c9518dfb98fc1c1924e310270e4c9965d42b80fd97531fbccafbec04c3fa67d7cec29140a83e37667426092ac6b60b95313cfccaa626df9072
-
C:\Users\Admin\AppData\Local\Temp\7D3F.exeFilesize
1.4MB
MD58fe166e995bbb1f5b9ed97a6b858cb17
SHA134b173b2ee5db7694c69732af29bdc92eb528888
SHA256e3ac933f39d5fa387a5f844d1d29379d88c4421aa72ac4e9b50d8bc1d5b40fa4
SHA51262a132abe46d212be81f0bd65184b397c80d87c46bd1728d9ec14cd40babd2d6ff61f6a3fe8d8d49be44e00ce28bae355b2059db8f95dfa918b8ac548f5a6432
-
C:\Users\Admin\AppData\Local\Temp\7D3F.exeFilesize
1.4MB
MD58fe166e995bbb1f5b9ed97a6b858cb17
SHA134b173b2ee5db7694c69732af29bdc92eb528888
SHA256e3ac933f39d5fa387a5f844d1d29379d88c4421aa72ac4e9b50d8bc1d5b40fa4
SHA51262a132abe46d212be81f0bd65184b397c80d87c46bd1728d9ec14cd40babd2d6ff61f6a3fe8d8d49be44e00ce28bae355b2059db8f95dfa918b8ac548f5a6432
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
\??\pipe\crashpad_1332_PQDYIIRYUDJBDOTGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/220-142-0x0000000000000000-mapping.dmp
-
memory/628-152-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-149-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-140-0x0000000002950000-0x0000000002DB2000-memory.dmpFilesize
4.4MB
-
memory/628-139-0x0000000000B96000-0x0000000000FAC000-memory.dmpFilesize
4.1MB
-
memory/628-136-0x0000000000000000-mapping.dmp
-
memory/628-172-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/628-146-0x0000000006560000-0x0000000006C86000-memory.dmpFilesize
7.1MB
-
memory/628-147-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-148-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-141-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/628-150-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-151-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-169-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/628-153-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-154-0x0000000006F10000-0x0000000007050000-memory.dmpFilesize
1.2MB
-
memory/628-170-0x0000000006560000-0x0000000006C86000-memory.dmpFilesize
7.1MB
-
memory/960-132-0x00000000005A2000-0x00000000005B2000-memory.dmpFilesize
64KB
-
memory/960-133-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/960-134-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/960-135-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1032-165-0x0000000000000000-mapping.dmp
-
memory/2576-156-0x0000000008500000-0x0000000008626000-memory.dmpFilesize
1.1MB
-
memory/2576-171-0x0000000008500000-0x0000000008626000-memory.dmpFilesize
1.1MB
-
memory/2576-145-0x0000000008500000-0x0000000008626000-memory.dmpFilesize
1.1MB
-
memory/3484-161-0x0000000001200000-0x0000000001806000-memory.dmpFilesize
6.0MB
-
memory/3484-162-0x00000000039C0000-0x0000000003B00000-memory.dmpFilesize
1.2MB
-
memory/3484-163-0x00000000039C0000-0x0000000003B00000-memory.dmpFilesize
1.2MB
-
memory/3484-160-0x00000000039C0000-0x0000000003B00000-memory.dmpFilesize
1.2MB
-
memory/3484-159-0x00000000039C0000-0x0000000003B00000-memory.dmpFilesize
1.2MB
-
memory/3484-158-0x0000000003190000-0x00000000038B6000-memory.dmpFilesize
7.1MB
-
memory/3484-157-0x0000000003190000-0x00000000038B6000-memory.dmpFilesize
7.1MB
-
memory/3484-168-0x0000000003190000-0x00000000038B6000-memory.dmpFilesize
7.1MB
-
memory/3484-155-0x0000000000000000-mapping.dmp