122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb

Resubmissions

28/12/2022, 19:37

221228-yb6lwabd55 8

28/12/2022, 19:35

221228-yandxaed9z 1

28/12/2022, 19:22

221228-x3lkcaed8x 4

Analysis

max time kernel
209s
max time network
212s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
28/12/2022, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Minecraft.exe
Size

397KB
MD5

d99bb55b57712065bc88be297c1da38c
SHA1

fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
SHA256

122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
SHA512

3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
SSDEEP

3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2524	chrome.exe
2524	chrome.exe
2212	chrome.exe
2212	chrome.exe
4660	chrome.exe
4660	chrome.exe
4692	chrome.exe
4692	chrome.exe
3404	chrome.exe
3404	chrome.exe
4924	chrome.exe
4924	chrome.exe
4780	chrome.exe
4780	chrome.exe
816	chrome.exe
816	chrome.exe
4704	chrome.exe
4704	chrome.exe
4148	chrome.exe
4148	chrome.exe
2308	chrome.exe
2308	chrome.exe
2212	chrome.exe
2212	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2724	javaw.exe
2724	javaw.exe
160	OpenWith.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe
2212	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2724	1636	Minecraft.exe	66
PID 1636 wrote to memory of 2724	1636	Minecraft.exe	66
PID 2212 wrote to memory of 2760	2212	chrome.exe	80
PID 2212 wrote to memory of 2760	2212	chrome.exe	80
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2736	2212	chrome.exe	81
PID 2212 wrote to memory of 2524	2212	chrome.exe	82
PID 2212 wrote to memory of 2524	2212	chrome.exe	82
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83
PID 2212 wrote to memory of 2016	2212	chrome.exe	83

C:\Users\Admin\AppData\Local\Temp\Minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Minecraft.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffee9244f50,0x7ffee9244f60,0x7ffee9244f70
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4616
- - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff67563a890,0x7ff67563a8a0,0x7ff67563a8b0
    3⤵
    PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1504,5309150350987860386,11654210204654148700,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\20221228202749.pma

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
memory/1636-120-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-121-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-123-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-122-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-124-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-125-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-126-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-127-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-129-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-131-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-133-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-132-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-135-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-137-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-138-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-139-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-136-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-141-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-142-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-143-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-140-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-145-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-146-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-144-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-134-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-130-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-128-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-147-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-148-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-149-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-150-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-151-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-152-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-153-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-154-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-155-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-156-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-158-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-157-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-159-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/1636-160-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

Filesize
1.6MB

Download
memory/2724-164-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-175-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-182-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-189-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-192-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-196-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-199-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-200-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-201-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-202-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-203-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-204-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-205-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download
memory/2724-206-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Filesize
16.0MB

Download