bazarbackdoor | 122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb

Resubmissions

27-12-2022 18:44

221227-xdvrqaba7s 10

27-12-2022 18:41

221227-xbt3eaba5y 6

Analysis

max time kernel
126s
max time network
153s
platform
windows7_x64
resource
win7-20221111-es
resource tags

arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows
submitted
27-12-2022 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LauncherFenix-Minecraft-v7.exe
Size

397KB
MD5

d99bb55b57712065bc88be297c1da38c
SHA1

fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
SHA256

122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
SHA512

3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
SSDEEP

3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK

Score

10^/10

bazarbackdoor backdoor

Malware Config

Signatures

BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
backdoor bazarbackdoor

Bazar/Team9 Backdoor payload 7 IoCs

Processes:

resource	yara_rule
\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
C:\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
\Users\Admin\Downloads\jre-8u351-windows-x64.exe	BazarBackdoorVar3
\Users\Admin\AppData\Local\Temp\jds7193237.tmp\jre-8u351-windows-x64.exe	BazarBackdoorVar3

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

jre-8u351-windows-x64.exejre-8u351-windows-x64.exe

pid process

2780 jre-8u351-windows-x64.exe
2904 jre-8u351-windows-x64.exe
Loads dropped DLL 6 IoCs

Processes:

chrome.exechrome.exechrome.exejre-8u351-windows-x64.exe

pid process

2656 chrome.exe
2656 chrome.exe
1556 chrome.exe
2616 chrome.exe
2616 chrome.exe
2780 jre-8u351-windows-x64.exe

pid	process
2780	jre-8u351-windows-x64.exe
2904	jre-8u351-windows-x64.exe

pid	process
2656	chrome.exe
2656	chrome.exe
1556	chrome.exe
2616	chrome.exe
2616	chrome.exe
2780	jre-8u351-windows-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exe

pid process

424 chrome.exe
1556 chrome.exe
1556 chrome.exe
2452 chrome.exe
2772 chrome.exe

pid	process
424	chrome.exe
1556	chrome.exe
1556	chrome.exe
2452	chrome.exe
2772	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

Processes:

chrome.exe

pid	process
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe
1556	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

javaw.exe

pid process

1416 javaw.exe
1416 javaw.exe

pid	process
1416	javaw.exe
1416	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

LauncherFenix-Minecraft-v7.exechrome.exe

description	pid	process	target process
PID 1688 wrote to memory of 1416	1688	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 1688 wrote to memory of 1416	1688	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 1688 wrote to memory of 1416	1688	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 1688 wrote to memory of 1416	1688	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 1556 wrote to memory of 280	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 280	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 280	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1668	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 424	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 424	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 424	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe
PID 1556 wrote to memory of 1932	1556	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6464f50,0x7fef6464f60,0x7fef6464f70
2⤵
PID:280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
PID:1668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1280 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1680 /prefetch:8
2⤵
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
2⤵
PID:1276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
2⤵
PID:1196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:2108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3376 /prefetch:2
2⤵
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:2284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3608 /prefetch:8
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:8
2⤵
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3908 /prefetch:8
2⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3756 /prefetch:8
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:8
2⤵
PID:2528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:8
2⤵
PID:2552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
2⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:8
2⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:8
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:8
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4092 /prefetch:8
2⤵
PID:2644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:8
2⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:8
2⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
2⤵
PID:2984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
2⤵
PID:2132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
2⤵
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=780 /prefetch:8
2⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
2⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
2⤵
PID:2156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4724 /prefetch:8
2⤵
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3948 /prefetch:8
2⤵
PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3488 /prefetch:8
2⤵
- Loads dropped DLL
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1040,13530266472614487960,13681051728299007396,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3952 /prefetch:8
2⤵
- Loads dropped DLL
PID:2656

C:\Users\Admin\Downloads\jre-8u351-windows-x64.exe
"C:\Users\Admin\Downloads\jre-8u351-windows-x64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780

C:\Users\Admin\AppData\Local\Temp\jds7193237.tmp\jre-8u351-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\jds7193237.tmp\jre-8u351-windows-x64.exe"
3⤵
- Executes dropped EXE
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jds7193237.tmp\jre-8u351-windows-x64.exe
Filesize
26.4MB

MD5
01eadcdf5dff5610d60d750c67839f31

SHA1
659d09bacd0f57002eaf5d91e2977365e813c1b4

SHA256
e485e7ded3728a38436063c2add08afd6e6e2e6fa5381215159a830818dfee77

SHA512
41cb083d3d0bf581cbb305705a3733b018964f8e090290e576f83242fcbb1e6cf2c34c20271e3ce75e01b2dc7467b4c80fb31f30eff38a70fd1305becd86311f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
3KB

MD5
5b758fbb3dbd968a8ccd18403ec20d2c

SHA1
5daa8448b01a6d6df9f477ddfdc10f1611e3c74e

SHA256
5ebb0151351da5b4f176aa98899b7a8fea67369cb29a902fb877405b35c447d0

SHA512
21b80345f7675511130b2ec679fac3905836d4e50f4efbd6252916ac7957772b6db1c9c27a8dad27e0a6a9388712d72e869e616e94a627fe6b5e13c26a13b44b

Download Submit
C:\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
61.3MB

MD5
31300d5a0e2e7ef983b45c1c14959dae

SHA1
dc516d4db34ff6eddf703622f0c0d4febbeb76e8

SHA256
de0f571f6afc797b77aaf4662f2a1a07a6a1abb4f96d0ce0dd1dc9f5a29bd221

SHA512
db1679a17f9b1eb81ac99833ae9da8d6ba59fd179776a7c851d586d07e9fba3db635aab2002b744bebef1ca12755a5394e8106e19b942e75967b69ed2f398f2a

Download Submit
\??\pipe\crashpad_1556_CROBBUBEMYZOQRYX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\jds7193237.tmp\jre-8u351-windows-x64.exe
Filesize
34.2MB

MD5
caa42489da32cef8b79b6618a0a9ca7f

SHA1
1ce30232fd80aef38ba8dd14d682666635fa3101

SHA256
ed1d50e9db268146f9e0f766a86696cee4a809a714ca047979551395bd51260f

SHA512
c716890e33aeb1ff2296db77ea67fa5142c82596f8f2590234ab97e41f4fc2a881c7d9bba882a79a2611b451e74a30ff2b27ab0dc1a74d392b47cf0d7c6beb5c

Download Submit
\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
34.3MB

MD5
85bf1bedab0526f60427cf2a1d3d6e16

SHA1
95932f7dc915444e37e120bfb538dc757aa4b118

SHA256
b299feb83139e2febd189639cf19010ced1398fa46da12ddaf8b778500835658

SHA512
f375436ee3d01f91e291a1549873e6b23dbd604a8a859120a32e533c05912241b422d6ca6cc557c5f08e5048e7da48c33fe7656912461eacc14b49fac33a2a82

Download Submit
\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
59.2MB

MD5
0909f971f64af1edf4645f63bd27f20a

SHA1
b0df70acb08e369455bd9fa432bbb7c3e8555977

SHA256
29c7f655df37d253072f96f5bdbcde9ce385429d2c68fe8d50041b45c371ae7f

SHA512
52bdb0cf8a545e42a2a33efdc7e8733cd1bb99f83ad23abd275392b8261fa2b222fab99129db0199f8550910f48318e251ca1d4e08fb3fd73d1877e991892c8a

Download Submit
\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
61.3MB

MD5
62407bc2558ac07efc4bff94668b4d2d

SHA1
05f0229275978a9299e578039fec60129808f011

SHA256
604eab42d69d63c3f93f7d5abbc51c0e810585ea1569636f33edeece1f71528f

SHA512
b51d4feef8db1dd6c0545ca7616784558b4fe8a439ee5f33734b272cafc26841b409da010c46cffaf3a67fb962d123be531fe60dbe9c3fa3cb0a55bfa99d7a4b

Download Submit
\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
61.0MB

MD5
15d5720a3d5ffe803b72e46d5e3236e7

SHA1
fc20296c76072a50ace5f55e016a3c06880a4e18

SHA256
9d74b446616a895c36964e09b258ac4fc0c563f11d61b556b7b32706e4b73552

SHA512
500bf101e9216f096c9a875fd17d2976b7fdb182524f35920c5bf6d27d5afbba0a84234dc8487a76b49fc23bb8babd48e0f1bdfd6a7e0bdaa5ac243b4ee044d9

Download Submit
\Users\Admin\Downloads\jre-8u351-windows-x64.exe
Filesize
60.9MB

MD5
f1c9e2625565d9c24c05aede072172e9

SHA1
0c15664fcd4665f12670b8a696f1777cff7c0748

SHA256
90d24335c76aa83cf5b9816caacd4fd2234bd2161533bbc765f8125ed7bf563e

SHA512
1882ab456ac96b39230c9f97bbd4d5c62356d3fa65604ceb45bb38723ec0081eb89e32fe2a92578df07941ab9282147ab52e46d25ffe92c6487f824a79af9f58

Download Submit
memory/1416-56-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/1416-74-0x00000000021D0000-0x00000000021DA000-memory.dmp

Filesize
40KB

Download
memory/1416-75-0x0000000002300000-0x0000000005300000-memory.dmp

Filesize
48.0MB

Download
memory/1416-55-0x0000000000000000-mapping.dmp

Download
memory/1416-70-0x0000000002010000-0x000000000201A000-memory.dmp

Filesize
40KB

Download
memory/1416-73-0x00000000021D0000-0x00000000021DA000-memory.dmp

Filesize
40KB

Download
memory/1416-69-0x0000000002300000-0x0000000005300000-memory.dmp

Filesize
48.0MB

Download
memory/1688-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/2780-79-0x0000000000000000-mapping.dmp

Download
memory/2904-84-0x0000000000000000-mapping.dmp

Download