Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
589s -
max time network
603s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2023, 18:27
Behavioral task
behavioral1
Sample
InjeXtreme + phantom2.0 + config.rar
Resource
win10v2004-20220901-en
General
-
Target
InjeXtreme + phantom2.0 + config.rar
-
Size
12.7MB
-
MD5
f187ee81e54fe181d09ec4d8cb6b086e
-
SHA1
2ab51afe95d4e297b6069038d845dcf1861ca302
-
SHA256
e4c28ab26cf6bc547927e9ebf5a3888202e3b70f5c08d55ae03f052cb71dbfbc
-
SHA512
119aa60e8f152e2a5e44f5a34f81c109c334791a058170ab43ee85c5cbf7e3143bf2847c0c3df639e7c44ad85df668d0ec47f6c84ad335074ad6b0403cc25932
-
SSDEEP
196608:pTRCeApQcv6POqVOP1Ba9o0IaH9FILSoPdr/K/lxuCI77f5+MXw5z0N2xdXRJMqX:OecQcyVcVUt2dDK/lxuD77MRxd3xX
Malware Config
Extracted
C:\Program Files\7-Zip\History.txt
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 5352 7z2201-x64.exe 5872 7zG.exe 5940 InjeXtreme.exe 4868 InjeXtreme.exe 2324 ChromeRecovery.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe -
Loads dropped DLL 56 IoCs
pid Process 2756 Process not Found 2756 Process not Found 5872 7zG.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe 4868 InjeXtreme.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 259 ip-api.com 249 api.ipify.org 250 api.ipify.org 251 ipapi.co 255 ipapi.co 256 ipapi.co 252 ipapi.co 253 ipapi.co 254 ipapi.co 257 ipapi.co 258 ipapi.co -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2201-x64.exe File created C:\Program Files\7-Zip\Lang\tk.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2201-x64.exe File created C:\Program Files\7-Zip\Lang\tg.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\License.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2201-x64.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5980_509182251\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2201-x64.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5980_509182251\manifest.json elevation_service.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2201-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2201-x64.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2860 chrome.exe 2860 chrome.exe 1732 chrome.exe 1732 chrome.exe 4236 chrome.exe 4236 chrome.exe 2008 chrome.exe 2008 chrome.exe 5272 chrome.exe 5272 chrome.exe 5632 chrome.exe 5632 chrome.exe 5684 chrome.exe 5684 chrome.exe 6072 chrome.exe 6072 chrome.exe 5000 chrome.exe 5000 chrome.exe 6084 chrome.exe 6084 chrome.exe 6084 chrome.exe 6084 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 48 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 5872 7zG.exe Token: 35 5872 7zG.exe Token: SeSecurityPrivilege 5872 7zG.exe Token: SeSecurityPrivilege 5872 7zG.exe Token: SeDebugPrivilege 4868 InjeXtreme.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 5872 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4324 OpenWith.exe 4324 OpenWith.exe 4324 OpenWith.exe 4324 OpenWith.exe 4324 OpenWith.exe 2360 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 3536 1732 chrome.exe 92 PID 1732 wrote to memory of 3536 1732 chrome.exe 92 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 4516 1732 chrome.exe 94 PID 1732 wrote to memory of 2860 1732 chrome.exe 95 PID 1732 wrote to memory of 2860 1732 chrome.exe 95 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96 PID 1732 wrote to memory of 4304 1732 chrome.exe 96
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\InjeXtreme + phantom2.0 + config.rar"1⤵
- Modifies registry class
PID:4424
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98fcb4f50,0x7ff98fcb4f60,0x7ff98fcb4f702⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1692 /prefetch:22⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:82⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:82⤵PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4824 /prefetch:82⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4820 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:82⤵PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:12⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5064 /prefetch:82⤵PID:5172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3924 /prefetch:82⤵PID:5164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6292 /prefetch:82⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:82⤵PID:5336
-
-
C:\Users\Admin\Downloads\7z2201-x64.exe"C:\Users\Admin\Downloads\7z2201-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:5548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:5744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵PID:5752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:5856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2384 /prefetch:12⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:5976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6496 /prefetch:82⤵PID:6036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=992 /prefetch:12⤵PID:6132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3060 /prefetch:82⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:12⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=992 /prefetch:12⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3280 /prefetch:82⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3364 /prefetch:82⤵PID:5400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:12⤵PID:5360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:12⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:12⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:82⤵PID:1948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:12⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:12⤵PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:12⤵PID:5604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:12⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:12⤵PID:5844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:12⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:12⤵PID:308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6784 /prefetch:82⤵PID:5804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:12⤵PID:5372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:12⤵PID:5180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:12⤵PID:5168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:12⤵PID:5300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:12⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:12⤵PID:5088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:12⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:12⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7840 /prefetch:82⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:12⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8028 /prefetch:82⤵PID:5732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8800 /prefetch:82⤵PID:6032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8836 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=996 /prefetch:82⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,7423355120689602106,6149131321249530693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:960
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4328
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4888
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\InjeXtreme + phantom2.0 + config\" -ad -an -ai#7zMap4407:126:7zEvent85311⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5872
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2360
-
C:\Users\Admin\Downloads\InjeXtreme + phantom2.0 + config\InjeXtreme.exe"C:\Users\Admin\Downloads\InjeXtreme + phantom2.0 + config\InjeXtreme.exe"1⤵
- Executes dropped EXE
PID:5940 -
C:\Users\Admin\Downloads\InjeXtreme + phantom2.0 + config\InjeXtreme.exe"C:\Users\Admin\Downloads\InjeXtreme + phantom2.0 + config\InjeXtreme.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4868 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:6008
-
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
PID:5980 -
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5980_509182251\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5980_509182251\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={75521b91-9170-474e-bed7-4de876562b5b} --system2⤵
- Executes dropped EXE
PID:2324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
Filesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
Filesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94