Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2023 16:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ibaillanos.tv/
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://ibaillanos.tv/
Resource
win10v2004-20221111-en
General
-
Target
http://ibaillanos.tv/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1430454466" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31007018" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09c77572a21d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb00000000020000000000106600000001000020000000b334857e9988f10918f2fcb47563c26ab2ada8646d9917915295669a1187e242000000000e8000000002000020000000b90bd2af01ff181338aad8855be2eef73590b0e91d1f09e54072894969d9ad0520000000c6cd45eb3c679b9a6c3c3fb2e0e625eb731e3d90f737683a6456a6859a372a0640000000d68067292873bfaa8eae105ad39c3674a106450db0c3e939e6f9a6a54b0652c56a829c6cd90e3152abc1b771f0cad0584102d55e826fd9556a9637f72b16cf30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0998b572a21d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1430454466" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31007018" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb000000000200000000001066000000010000200000000fc844390210a5bbf6ab8074dc7feb00c7f911fd906f3d42269e556003350e1b000000000e8000000002000020000000d1410ea95119494245f922fb72104e81b72472059f0c5e02a57007bb7a8ab6032000000029295ab58979dc44238b5183bbe5a32f6104e29936880c6200f3a83125efde24400000003c1498cf7e39e5457174336c8009811349f881c1130c900032a784da130adee80324122da66e2c2c70494ac8fbb5a5dc626fc50d406320ccd0186ce9ee9b8676 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{80AA78B3-8D1D-11ED-BF5F-6EDF9685419A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Modifies registry class 1 IoCs
Processes:
IEXPLORE.EXEdescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2386679933-1492765628-3466841596-1000\{E7B89F0F-EDB7-4FC2-AA2C-7EB1E394E8BE} IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepid process 4720 chrome.exe 4720 chrome.exe 2380 chrome.exe 2380 chrome.exe 1716 chrome.exe 1716 chrome.exe 1528 chrome.exe 1528 chrome.exe 1544 chrome.exe 1544 chrome.exe 3188 chrome.exe 3188 chrome.exe 4204 chrome.exe 4204 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
IEXPLORE.EXEAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 872 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 872 IEXPLORE.EXE Token: SeShutdownPrivilege 872 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 872 IEXPLORE.EXE Token: 33 1100 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1100 AUDIODG.EXE Token: SeShutdownPrivilege 872 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 872 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
iexplore.exechrome.exepid process 4712 iexplore.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe 2380 chrome.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4712 iexplore.exe 4712 iexplore.exe 872 IEXPLORE.EXE 872 IEXPLORE.EXE 872 IEXPLORE.EXE 872 IEXPLORE.EXE 4712 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 4712 wrote to memory of 872 4712 iexplore.exe IEXPLORE.EXE PID 4712 wrote to memory of 872 4712 iexplore.exe IEXPLORE.EXE PID 4712 wrote to memory of 872 4712 iexplore.exe IEXPLORE.EXE PID 2380 wrote to memory of 3716 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3716 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 1972 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 4720 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 4720 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe PID 2380 wrote to memory of 3500 2380 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://ibaillanos.tv/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4712 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810f14f50,0x7ff810f14f60,0x7ff810f14f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4520 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2732 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,9381229362642354910,766275453378159789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5604 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD588cf5e4e84460f7e0ba315bc905aa309
SHA1a41fecee55836c7c085ac1609274e44e0f5543ef
SHA2566bea6f0b38e50a86aaf6adb4052229712bc93530275e6b690c6f3b99cae473c8
SHA512e0896008035976a14cedb2f03e8c91102d11fd1481ea61887ea83bc768d95d6244cecd2f4ea99953e437971733533436b98c380f687f06e9378e366b2e684f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8Filesize
471B
MD55dcd3e3f6440384500af24c809a3f175
SHA13a5df7e2369c9d65865d73410b0cac87e1b5a54c
SHA256b7c5a41dbd443dcb04231372b9ac63a3853d57e43941af5b22073693291099df
SHA512857ae1a764d38b13efefab0e1222c7aeed2b446f3d1348ae8ff1f7048aab2e6ce5662bae0bd7579169ca0335d17d43b6a5664ce065ee6d16feac7e82e4183611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217DFilesize
472B
MD5561e959ce9eff04b09da6f3def82f549
SHA17866f989cdfb160709f4c93b767fd01e5553d75b
SHA2569076b4ae1a34ab02b362ffa44ecbf6d579f82042cfd7e7138977477ea5bd3e61
SHA5123e3ad98d38d37962518febb21eba312e17e26301bd06bcfd1ec4a7b1cf8c7eba23143872ceeddd794a342750dcf481ae197f04dd7e74bd71fce68858e963b380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD501b3cba9e1bc64d53f3571dea09faff5
SHA13d1eebb11ea9c4c4804479ea90abd25de675cff7
SHA25611bae1db0382f4e35ab39166a90e7366b64c92e8931550646de05778756c1bc3
SHA5129293745b190749d9669b64da858981d428cf8a387c4caaf2f3a7796fba35cf4fa7375beaf42b623ec3116be73fbe43a0aedfa85e5c3f87a66844d91ca776cd84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8Filesize
410B
MD5e2b4126aa2cfe271cacfd49f3c07ef2f
SHA19c7a86db4d01a2b3bc70ba4af5cd0edd6c636b99
SHA256adbb91d81a35e0980b52bb10de8edcc7e7970c5b97ae758a53b1e4d5adbdfb54
SHA51259058ebf524c1c71948d0496997c7ea461d13a58da7bc31f2fe40b068004649479aad899fe98659ef880b4182a0923231f77bef62908243609b8efdde30ddf48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217DFilesize
402B
MD5aea3c89ca3a2231445506c0d0d6da632
SHA1bf82113383c8f8f56a2fb57b5e7cfba3cbf5d7aa
SHA256c72d6d54f86f7efd32e55a10cbd0284af5afa7b3c41c8e386190383bc414a6b8
SHA5122488c1a3ac043d0e6a84296af6e5bb29755463cf4d784314c9d3f389f7465fa273b867951648fea916aeff408d481d78a08eb6ca4b8abd72c2a16a6c9d0fc388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD5435c6c4a88734130a228456c5b229109
SHA1182ae4e3ef10f385f04b9ee1fcd3e484779c55ca
SHA25609bf3fb28a686578b8809a49910b63162ac7ca8c58732d1ca947fd611e8553ec
SHA512f0512efb1d9ccaf120154216c77f8a3fd0cb8b3aa1869fb76ee91325c1f4b5b775dca19470cce4bec2b19082fdcab626df79e569251795131e6eb075bffbfe5e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_2380_RRCCDVMSULDAPWPVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e