redline | 662735f537c23f4f570b9018a69bcd5d9ca1c908ab5e390e90cfb08275107627

Analysis

max time kernel
803s
max time network
822s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/01/2023, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftwareSetuрFilе.exe
Size

690.4MB
MD5

95b35f12fb70251d52cc693e147133c0
SHA1

1f8c5cc37c24f6ccec159de07edf3fc64104d66b
SHA256

445990599534816991c6ccf1781763f855e1beff0f2d7f9305a95938edfafbcf
SHA512

a4dfd8e2b3a513425c427f0b131b139e6ff7a69eabd2b2edfbea63a3ceafe54d06163a395e160b64c1e3a2406439637c8addd57e154b7b8050daf940afea0d40
SSDEEP

49152:WmVlA7GqB6/KWpXeJpyYmJdIiDix/TYLAbJMZnMw2tNn1Or/GtXEJ+GRgD6Vk3j8:18Na5XeJQpU/sLAKnMwoyXsm

Score

10^/10

redline meta discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1992	SoftwareSetuрFilе.exe
1992	SoftwareSetuрFilе.exe
516	chrome.exe
1028	chrome.exe
1028	chrome.exe
2828	chrome.exe
2820	chrome.exe
2364	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
2216	chrome.exe
2536	chrome.exe
3024	SoftwareSetu-ÇFil-¦.exe
3024	SoftwareSetu-ÇFil-¦.exe
2288	SoftwareSetu-ÇFil-¦.exe
2288	SoftwareSetu-ÇFil-¦.exe
2468	SoftwareSetu-ÇFil-¦.exe
2468	SoftwareSetu-ÇFil-¦.exe
2896	SoftwareSetu-ÇFil-¦.exe
2896	SoftwareSetu-ÇFil-¦.exe
848	SoftwareSetu-ÇFil-¦.exe
1100	SoftwareSetu-ÇFil-¦.exe
1100	SoftwareSetu-ÇFil-¦.exe
848	SoftwareSetu-ÇFil-¦.exe
1576	SoftwareSetu-ÇFil-¦.exe
1576	SoftwareSetu-ÇFil-¦.exe
2560	SoftwareSetu-ÇFil-¦.exe
2560	SoftwareSetu-ÇFil-¦.exe
3012	SoftwareSetu-ÇFil-¦.exe
3012	SoftwareSetu-ÇFil-¦.exe
1952	SoftwareSetu-ÇFil-¦.exe
1952	SoftwareSetu-ÇFil-¦.exe
1600	SoftwareSetu-ÇFil-¦.exe
1600	SoftwareSetu-ÇFil-¦.exe
2360	SoftwareSetu-ÇFil-¦.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	rundll32.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: 33	296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	296	AUDIODG.EXE
Token: 33	296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	296	AUDIODG.EXE
Token: SeDebugPrivilege	1992	SoftwareSetuрFilе.exe
Token: SeDebugPrivilege	3024	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	2288	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	2468	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	2896	SoftwareSetu-ÇFil-¦.exe
Token: SeRestorePrivilege	2572	7zFM.exe
Token: 35	2572	7zFM.exe
Token: SeDebugPrivilege	848	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	1100	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	1576	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	2560	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	3012	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	1952	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	1600	SoftwareSetu-ÇFil-¦.exe
Token: SeDebugPrivilege	2360	SoftwareSetu-ÇFil-¦.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
2572	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe
1028	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1912	1028	chrome.exe	34
PID 1028 wrote to memory of 1912	1028	chrome.exe	34
PID 1028 wrote to memory of 1912	1028	chrome.exe	34
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 1052	1028	chrome.exe	36
PID 1028 wrote to memory of 516	1028	chrome.exe	35
PID 1028 wrote to memory of 516	1028	chrome.exe	35
PID 1028 wrote to memory of 516	1028	chrome.exe	35
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37
PID 1028 wrote to memory of 1972	1028	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\SoftwareSetuрFilе.exe
"C:\Users\Admin\AppData\Local\Temp\SoftwareSetuрFilе.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5644f50,0x7fef5644f60,0x7fef5644f70
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1128 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3292 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2432 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1356 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=544 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1120,3787509384982910290,5733719013637942326,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:2996

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2468

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\SoftwareSetupFile\Privacy Polic-â\ActiveXInstallService.admx
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2696

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2572

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe
"C:\Users\Admin\Downloads\SoftwareSetupFile\SoftwareSetu-ÇFil-¦.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
431df692fa4e72e62b3902867faa1b91

SHA1
7e0a6e5af384a98b5de7387c6c019f8951107a06

SHA256
6b0fb234989a4f9fd1f807f9101b7bf1ca3f7d87ab67cef1a654f60260c19365

SHA512
68c27c6b1dade0f4e9fea5dd01aaf1b0e276625fd6f934a7e1d2b2e976162d262a4d9a0e674fe42689b28a9b11213aea57d06389dbbc4f0c18520d7180a3d427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies

Filesize
20KB

MD5
208c4b7e6e74b5578fc5af6e396218e6

SHA1
c42792059134ac63d1926781d83817c45ce30c93

SHA256
b2d21c9c3d39f7c21f6fbd013deb3695f9dc47647ed3f920b66fa4dc25d70a56

SHA512
010db839d1a98e51b203967b82fac38506b326fcfd3f20759eac4fcae208706f038f7acd6d3af49beef0bcc9c65d64dad604f5cbbdc1413eccc4448a648cc2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
88KB

MD5
bda3657fda0e8941a5cbef7de7be5427

SHA1
3b5ce2e1e212d8dbd0d23f898d97b9fba6c578d7

SHA256
346fb0f9f18999eb4aea9eb308b7771220511d2daefe0646326ad3e7e051e618

SHA512
064e9ed427923843101a5dd92063bb71f2db6871abdcda1bf97810672c03920a5d003773c33ecac36137e21a4ad40185e6efc1296131c5f0602a81ff369fe148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
124KB

MD5
5bd4bcbcb4d8e42ac74727e0a572e7d1

SHA1
cae229f9ff5f256624c7e7760572f196d8483133

SHA256
e2f44159256cc0f4ebfe218c1f04a279d90d6609c09dd77b4db4b83fb5270a91

SHA512
671b9d3da09fa8631653a9c816b1d6ac583dc027fae88853ee9f7d83755fda83aaa7b98fd9472ca077fc10a63ca518c6f6b27cd5547c8bda0ec6ac3284a1e294

Download Submit
memory/848-84-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/848-81-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/1100-82-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/1100-86-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/1100-90-0x0000000010840000-0x0000000010872000-memory.dmp

Filesize
200KB

Download
memory/1576-93-0x0000000010870000-0x00000000108A2000-memory.dmp

Filesize
200KB

Download
memory/1576-85-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/1576-91-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/1600-105-0x0000000000C10000-0x0000000000D10000-memory.dmp

Filesize
1024KB

Download
memory/1600-102-0x0000000000C10000-0x0000000000D10000-memory.dmp

Filesize
1024KB

Download
memory/1952-98-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/1952-100-0x0000000010840000-0x0000000010872000-memory.dmp

Filesize
200KB

Download
memory/1952-101-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/1992-54-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

Filesize
1024KB

Download
memory/1992-57-0x0000000010890000-0x00000000108C2000-memory.dmp

Filesize
200KB

Download
memory/1992-56-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/1992-58-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

Filesize
1024KB

Download
memory/2036-55-0x000007FEFC361000-0x000007FEFC363000-memory.dmp

Filesize
8KB

Download
memory/2288-66-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download
memory/2288-71-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download
memory/2360-108-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/2360-107-0x0000000010870000-0x00000000108A2000-memory.dmp

Filesize
200KB

Download
memory/2360-104-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/2468-72-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Filesize
1024KB

Download
memory/2468-73-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Filesize
1024KB

Download
memory/2560-88-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/2896-75-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/2896-77-0x0000000010890000-0x00000000108C2000-memory.dmp

Filesize
200KB

Download
memory/2896-78-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/3012-97-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

Filesize
1024KB

Download
memory/3012-94-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

Filesize
1024KB

Download
memory/3024-65-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/3024-63-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download