Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/12/2022, 16:55
221222-ve6jhaeg75 8Analysis
-
max time kernel
262s -
max time network
271s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22/12/2022, 16:55
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.feetcare.co.il/.mon/[email protected]
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://www.feetcare.co.il/.mon/[email protected]
Resource
win10v2004-20220812-en
General
-
Target
https://www.feetcare.co.il/.mon/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = a06204ca2e16d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://login.live.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url8 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e007aa2e16d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url7 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 2039e7ae2e16d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://www.feetcare.co.il/.mon" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005569bda0978b3e47aae5e3374d5a469800000000020000000000106600000001000020000000a8c3e9ef4e6953b216e7dd5920194c502f406cc1e108ffefaee1ec9d11731037000000000e800000000200002000000035a15f82011c0eb9022cc7f4a71950d050ba1efada372487bad286ef6142a6f0200000002b0967b404e586cf2e12e365286d5dc7066a9e0df8874d25e669c03c6529c5344000000040fcc588b27d434834960e2fd0ea9eb88ac2e4eb0ba2479f5bef5d0bcda30f83bd2dffa2b1a9e131f8fc486dbff0b473a8fc0601f61ddbec93adf76bbbbf1db2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://login.aliexpress.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.feetcare.co.i/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.aliexpress.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://twitter.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 2039e7ae2e16d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 20498fd82e16d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://www.feetcare.co.il/.mon" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005569bda0978b3e47aae5e3374d5a4698000000000200000000001066000000010000200000004ad5004969ec3a4ef462a7d03e99342ce9e02e8c857d7445e455cbc0b0d3673a000000000e80000000020000200000009064a021984525da109fab5f412398c4a0f8b17e3c651f6687ebd36c46e31c2490000000c3fba4250d5b89c822c767fbcce221940c2c284d4d9e625fc0633fdab088b445d7a75b16e36daac94fb9d93ded7b7b023ff04ac7ba6079150d20b310c070dbe440342290c7b997316c76cae06160aef4ea8459febf1fb577ce800aa8ab9146fb80ca772cd074bb3035677eaa861354604b881b0e721ac9377d376a6b0b21b9f728f8edb5ab29b0a101279e75d16d19a140000000e349d814c664bfb18319c5097928cf2b6e9aa77abbefd5c78e984470acd54f1dbaa6f1fd50efb2ab8c6aeb800161e39f15616e225711b700fa4e550a59e34e52 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://www.facebook.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://www.feetcare.co.il/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.feetcare.co.il/.mon" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = a06204ca2e16d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url8 = "https://twitter.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE609081-8221-11ED-84F9-5A21EB137514} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://www.feetcare.co.i/" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1776 chrome.exe 1436 chrome.exe 1436 chrome.exe 2160 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 900 iexplore.exe 1856 msdt.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe 1436 chrome.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 900 iexplore.exe 900 iexplore.exe 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE 2044 IEXPLORE.EXE 900 iexplore.exe 900 iexplore.exe 900 iexplore.exe 2044 IEXPLORE.EXE 900 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 900 wrote to memory of 2044 900 iexplore.exe 28 PID 900 wrote to memory of 2044 900 iexplore.exe 28 PID 900 wrote to memory of 2044 900 iexplore.exe 28 PID 900 wrote to memory of 2044 900 iexplore.exe 28 PID 2044 wrote to memory of 1856 2044 IEXPLORE.EXE 31 PID 2044 wrote to memory of 1856 2044 IEXPLORE.EXE 31 PID 2044 wrote to memory of 1856 2044 IEXPLORE.EXE 31 PID 2044 wrote to memory of 1856 2044 IEXPLORE.EXE 31 PID 1436 wrote to memory of 896 1436 chrome.exe 39 PID 1436 wrote to memory of 896 1436 chrome.exe 39 PID 1436 wrote to memory of 896 1436 chrome.exe 39 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1692 1436 chrome.exe 40 PID 1436 wrote to memory of 1776 1436 chrome.exe 41 PID 1436 wrote to memory of 1776 1436 chrome.exe 41 PID 1436 wrote to memory of 1776 1436 chrome.exe 41 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42 PID 1436 wrote to memory of 1412 1436 chrome.exe 42
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.feetcare.co.il/.mon/[email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\msdt.exe-modal 459030 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF1076.tmp -ep NetworkDiagnosticsWeb3⤵
- Suspicious use of FindShellTrayWindow
PID:1856
-
-
-
C:\Windows\SysWOW64\sdiagnhost.exeC:\Windows\SysWOW64\sdiagnhost.exe -Embedding1⤵PID:820
-
C:\Windows\SysWOW64\sdiagnhost.exeC:\Windows\SysWOW64\sdiagnhost.exe -Embedding1⤵PID:1240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70c4f50,0x7fef70c4f60,0x7fef70c4f702⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:22⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:82⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:12⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:1324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1104 /prefetch:22⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1000 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:82⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3984 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:12⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=540 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2428 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4156 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3148 /prefetch:82⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD553eaa70d4c1b94060c20df57cbf27fee
SHA19d460df79c94306bf99816428cdd8d81b7c85196
SHA2561b937ef4024075320d862254ac754ecd9636a5a18c035120498baa4a434f6dc6
SHA51254d1ba5a2cbac9dd7046eae10bc01dd5123e97acb2cbbbaf8fcee172e8b41ec0ed9bd444e5db09f898db36e66901e549547532e71d25938dbc9aa3152b49f60b
-
Filesize
3KB
MD5477616a4900a80b42d228423aea759d5
SHA1b29df8ccd2962c74223611ecc3de93512a86ef73
SHA256936fda8fda3f27fb1a47798cc0f58736b97a6f5d4f1652ec4590106b8b481b60
SHA512ff04cfcd9e5971e03beb4661c8ad0ba398a73423cd097c74835f9dc599559995610e7eafa8cd5109c22567d44e3fa6aee7e80872632de683cb00aed4465356fd
-
Filesize
606B
MD5b916aa1bee0398aa570bbfe8c815aef7
SHA1a78ce4292cc67363e13edfd05b109957b5a7d882
SHA25662d6f28c5c98f2b8f2d674f2c0f706df0552c7668f90ee25770699c55adc3784
SHA5129fd959edd401d36da915f8c38b0e6458917b67602cc7fe2a7c1c157df44375077f14a20bc8976fde1ff84c06b7e7e17b22b4938cb3b1e528b8d8e7ec5932b45f
-
Filesize
23KB
MD51d192ce36953dbb7dc7ee0d04c57ad8d
SHA17008e759cb47bf74a4ea4cd911de158ef00ace84
SHA256935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756
SHA512e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129
-
Filesize
567B
MD5a660422059d953c6d681b53a6977100e
SHA10c95dd05514d062354c0eecc9ae8d437123305bb
SHA256d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813
SHA51226f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523
-
Filesize
52KB
MD52f7c3db0c268cf1cf506fe6e8aecb8a0
SHA1fb35af6b329d60b0ec92e24230eafc8e12b0a9f9
SHA256886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3
SHA512322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45
-
Filesize
2KB
MD50c75ae5e75c3e181d13768909c8240ba
SHA1288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA256de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
SHA5128fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
-
Filesize
5KB
MD5dc9be0fdf9a4e01693cfb7d8a0d49054
SHA174730fd9c9bd4537fd9a353fe4eafce9fcc105e6
SHA256944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440
SHA51292ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66
-
Filesize
23KB
MD51d192ce36953dbb7dc7ee0d04c57ad8d
SHA17008e759cb47bf74a4ea4cd911de158ef00ace84
SHA256935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756
SHA512e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129
-
Filesize
52KB
MD52f7c3db0c268cf1cf506fe6e8aecb8a0
SHA1fb35af6b329d60b0ec92e24230eafc8e12b0a9f9
SHA256886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3
SHA512322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45
-
Filesize
2KB
MD50c75ae5e75c3e181d13768909c8240ba
SHA1288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA256de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
SHA5128fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
-
Filesize
5KB
MD5dc9be0fdf9a4e01693cfb7d8a0d49054
SHA174730fd9c9bd4537fd9a353fe4eafce9fcc105e6
SHA256944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440
SHA51292ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66