ea61e59c58d8a80829c6ad565d292d716280d926e7bb1439cb0268a66264941c

Analysis

max time kernel
144s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MouseJiggler.exe
Size

983KB
MD5

27164f23585f4f1e5f63212c39c5a2cf
SHA1

01cf73eac1b234c0cb1cb74ac1d7d9cf410c5b16
SHA256

1ce344ef37998f2d2bdd6abcb121a08ef17f02ccfdc601f2da9bef6d02b00f7e
SHA512

0b664fce3b180f45b25e989986893ec05a7ed549c054a1be83b9bb66ba7d05a14d19866c3cd77f8ec893dd6416c2d916b7e833edc5cc71f99fa0857a1609b886
SSDEEP

12288:MeLDpZQ29k9tT6YY4u0dgZHxF+Ix8/Bc0ZireYeCs/l+QWBWqO9dY95p:9DHp9ky4xg/UBc0MeYeCs/l+QGAdOT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 47 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E49AA801-8617-11ED-B390-DA7E66F9F45D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a815e879e6660c4da005405f72cd69ce00000000020000000000106600000001000020000000071432e7f75fd913bd677c7c2ec0a44d58e4510707db6baa374f201e2a6be3fb000000000e800000000200002000000084ace224aec2e8af051890efd346cf0fa619848007d98fb9afedb151b92a0365200000000d989eac61b6f93a46105cbb483d46e072fe676f87d9fa4be8a6ab427c24059740000000278341d418c7c14d16a89b16918f002fa98dd007d8d46c37ac72e32d3ed26a8becce30b3603dfabc91c8831693cb98679ecd87f91a328948831b371ff9953765	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a815e879e6660c4da005405f72cd69ce00000000020000000000106600000001000020000000b0d479bfd40fc349812cfa039c17dc0e0c5ca5f03068b6c5b9ac3d13207225f7000000000e8000000002000020000000b099cb79592deb4b547ceb973552ee9e08c0eafc9d85a35fe4edfb90f628ac989000000043aa8bd0d42e69ad5199b660ebe83e86ab709c9c1c39d0ade91118d78de27b3d3226a05a06e4d733da1bde286eadbe9fba9584d52cc0e5f52f2fd0bf14e87e922100f0eb8bbb4dea7f80a11e97d9bd50d6eeddb6182b376089c2d7e2c4e11eefbe16e0e8535c003a546f7055a4267232611c40a7fd513a8d4a9450c52877b39ad4531d07653a91122b325585b81e955d400000008fd6f78cacc491734541bc8e146ec2db47a481050c639a58930f8a2afd5adb49035f3fbb3017f648fec53fa20ad28ce41d3fbb7e6769b0e6dbac55a3258708dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "124"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01f33b2241ad901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378932245"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

chrome.exechrome.exe

pid process

1888 chrome.exe
1032 chrome.exe
1032 chrome.exe

pid	process
1888	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exechrome.exe

pid	process
808	iexplore.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

808 iexplore.exe
808 iexplore.exe
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE
1120 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MouseJiggler.exeiexplore.exechrome.exe

description	pid	process	target process
PID 1500 wrote to memory of 808	1500	MouseJiggler.exe	iexplore.exe
PID 1500 wrote to memory of 808	1500	MouseJiggler.exe	iexplore.exe
PID 1500 wrote to memory of 808	1500	MouseJiggler.exe	iexplore.exe
PID 808 wrote to memory of 1120	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1120	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1120	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1120	808	iexplore.exe	IEXPLORE.EXE
PID 1032 wrote to memory of 704	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 704	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 704	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 844	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1888	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1888	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 1888	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe
PID 1032 wrote to memory of 636	1032	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\MouseJiggler.exe
"C:\Users\Admin\AppData\Local\Temp\MouseJiggler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=5.0.4&gui=true
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:808 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ae4f50,0x7fef6ae4f60,0x7fef6ae4f70
2⤵
PID:704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
2⤵
PID:844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1724 /prefetch:8
2⤵
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
2⤵
PID:1184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3244 /prefetch:2
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3404 /prefetch:8
2⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:8
2⤵
PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3440 /prefetch:8
2⤵
PID:2464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3320 /prefetch:8
2⤵
PID:2476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:2700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
2⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4608 /prefetch:8
2⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4616 /prefetch:8
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=784 /prefetch:8
2⤵
PID:2992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1092,12029435667468749764,3037806692671523575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2352 /prefetch:8
2⤵
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
Filesize
1KB

MD5
6ecc83c79585c58fc0817fa18311bc13

SHA1
e9d3e2939130fd756c58a9e4362a7bc8ac955515

SHA256
45e34f121c64b93a89cd84a9dbbe15e317622bd6409e54ab36b3fe4ed08d60e2

SHA512
175f38dbba5bbaa4e60b6e04ff1843755bf6a6b44414dec515b40afcd5495d5df1d27d4415c8ccb6279c36a0f61a3fe9169770624924e40eff6eb495e95c83b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
471B

MD5
206102bdc0dcf6f76cc29f75f11f904f

SHA1
631dff755386f877138ecb0777b4d20649d2ee13

SHA256
5187ed01ee06cb178fc17a16715b15d81a57ea8bcd4855cf24deb83ae1874b4a

SHA512
19ac8a4f309cffd41d7f0570025a47d8649e56ecc06512c741d053dd9b736233a1668b5755e215c86de82ac5ffb98dda2aa38ece4b86232aa060f9dc636d6d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
832c91591e78aee9f6ccd7a8b7934bbd

SHA1
b90a6e8d8f7d5ce820526621fbca65e93f1017e9

SHA256
71ba7f91b1eb5f01d1632e491c4c8225a76928f18bb15f7d709545289da94796

SHA512
6b9c2777b10936909226080e867f8f772cb67d0225415a71c1c69ed3ef3204d103506635dc73fe1b2264857efdec8775bf75c0ef5a06404a2b2370b50a8d1f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_AD319D6DA1A11BC83AC8B4E4D3638231
Filesize
434B

MD5
8641adf58d6d13380c0ab39dac9f94bf

SHA1
8a2750597f9cf0cddb785890207909e9da9ccd92

SHA256
e142a7a0e1214268e6d86b7105c7ecc19034ad9004008f174f752a663070f3c3

SHA512
9627aa246b603b60b31cb22afa88df806a144b7eb26a80cf8f8d7f403a8bf2ca36bbd1d98ac744714c38440076e77bbfcc3150246ffe5fe011d9e43248cd6938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d920478f983f4e47a1a6fc28c9e2c8ae

SHA1
ffcbd6bb29175c92c54d8423154f8af4934310ad

SHA256
42693e7943ca61ff256cddc6ea3fa7b89e0adedcdd519f34c91af2e139784fd9

SHA512
84d0c83a247a1b9743d351a24439f4864f04eb096ec8afb6b66e1296f0ac1a8ae58c5d5ddd34512940f5e2cb4cd1360234a7b33989f7cf22968af2f9a02bec0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
66ea25d146447501206f36057303161d

SHA1
5d6a1e81635a2422e06c44cac39e78a3d4061cef

SHA256
3546bf3fbc03f00955cef48b7b567328cb14bc04a48d86ff92daa57cecc1a630

SHA512
8b9280b569cec579db641b7174610b4672385f6c23d717e9cdf1b2b8bda0b3743c84e267b5f0d0e135e8505d07e154626206589ce5a45e61fb688fe4b0dad3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
430B

MD5
6c0975fb885518eb4fd16334582eb81c

SHA1
c2fe8a317e6c7fa842274b5c5fafafd5f8d02528

SHA256
444b2e571ffa906b882af3661b0d15498d4ca971d964a8d2afbd58e0e39cc1a7

SHA512
ca7b16d4d3bb97c6114f97173d7fb965cfedb207e97f76664f78a7410ed807fe1a601831c583011aec0263fe94cc61b6b047fe19ccaf0a352969c8601bdab68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
353ce8d4f6f324a92dee94e53d074201

SHA1
d384abc127ab065ba3b67043f50f88b76745dcb7

SHA256
3a836ce741a8955df92b1502d86cb12f660080932bb2b9ea202614d3f3a58de6

SHA512
86120e57211fb244318d6da023ad49a8d9fb156b7f48d99ebe9e6dd208eaa14f2e3dacb4ad0bfdd755b72b471b4fb8231adf362593d2e93d8510cd39e27d1dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat
Filesize
21KB

MD5
546b59fe57f62f075ffbf4ca6a247216

SHA1
827424abfcb813aed4dbb0e14d5aa3ad53181f11

SHA256
006fb533ad61b136a9a16c672fda233d1b3a64fed0a5036edeb75844590495a2

SHA512
fd4d3ad9a221aef70f11bd743d11fa79c380c55a5b2e6774d53db6be5243b0cfe6f5f817832580e8ee1bbc049cb997e45087ca90c97be629716025ac92eb7ae7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WFW17Z91.txt
Filesize
602B

MD5
0eb34a40769ee2cb5d36f6f9664f58fa

SHA1
e102f84c3bd1535e8e327718e119c8a6f8451b6f

SHA256
bd0e5cecc9de01c7d3dd2f58210f7b097753bf2902abd4c83747c94131dfb70f

SHA512
359c461025060d0fa971148d0fcff211cca180338f65be919618859fa247b5ec8bd8f57e895a4339fa2a070b17614e4c39f0cb36d630fc38aa8d1a8e748c2487

Download Submit
\??\pipe\crashpad_1032_ZGKAMPZMOGESQXYN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1500-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download

pid	process
808	iexplore.exe
808	iexplore.exe
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE