Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
491s -
max time network
512s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/01/2023, 10:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://youtubepi.com
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://youtubepi.com
Resource
win10v2004-20221111-en
General
-
Target
http://youtubepi.com
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe iexplore.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 50e2a9ceb325d901 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = d0ffea0db425d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "200000" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://login.live.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url7 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "180000" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://youtube.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "140000" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://www.facebook.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FEB2931-91A6-11ED-BB27-6A94EDCEDC7A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ec8206b0e0a2e48ac0443653ec70f01000000000200000000001066000000010000200000005a012d00ad3ec4157efb83e55f6e287a035252f2d8610e6070fec8273db3dd47000000000e80000000020000200000005cd5873a5b2fa6c24f8f3d08dd2789f70d10a645d79bae5bf2a524471092a2082000000097f9deb0708210572552a364b5a9f1cf5d5bc0c177944ab6e1e064d7876ebbb24000000094756ce6b3e5f1b2fe303597dc023f506aff07639fb9abc4638411f6b32d2678e96cb3a1d4bc13bf14ecf99ae39f852dbb3ce57129c7815d5a356979e326cb61 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://youtube.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "https://www.youtubepi.com/watch?v=gMX9TdI9zSI" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://twitter.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 404d76a2b325d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60334f5fb325d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 404d76a2b325d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ec8206b0e0a2e48ac0443653ec70f01000000000200000000001066000000010000200000009afec824d62901101c0f5684aeba4a8b834cfd84f7f8ebb077184a6667849ee4000000000e80000000020000200000008fc2be9df1792b3bff7bd58c4a7ab89c5d0e1917ef47fe26d9fb3341ae20930f90000000701a5d0093f0eaa10c8a3b894e07878b821378d89a65b6777e66a333bba6d24297351819c5cee8acd7d2b3f62d7829beca29c00b0a4b7e793f7c52e2c10811b7c6600a35458c06611607d96de49d4ab1aeef7e93968576fffdb5015f0bc9cf59310fac032bb64ea46c77938aa589168a8287693f7a259a8ee73847e481c4ef9e1f3a4b6a17331e20e1256794a3f4d40b4000000099172626a4c3355c89e921788b123d54aa427c7761e5db778a2b19c7c3eb0a41fe8591e8a5bf0f3a1250dc86c1166f372324a3304bd02c3fbeac18fa16c6e417 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380202957" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file\ rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 88003100000000000c551c75110050524f4752417e310000700008000400efbeee3a851a0c551c752a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications\chrome.exe\shell\open iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.json rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file\shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications\chrome.exe\shell\open\command iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications\chrome.exe\shell\open\command\ = "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" \"%1\"" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications\chrome.exe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Applications\chrome.exe\shell iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1684 iexplore.exe 568 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 1100 chrome.exe 2584 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1684 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 3008 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3008 AUDIODG.EXE Token: 33 3008 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3008 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1684 iexplore.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 1684 iexplore.exe 1684 iexplore.exe 1684 iexplore.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe 2008 chrome.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1684 iexplore.exe 1684 iexplore.exe 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE 1112 IEXPLORE.EXE 1672 IEXPLORE.EXE 1672 IEXPLORE.EXE 1684 iexplore.exe 1672 IEXPLORE.EXE 1672 IEXPLORE.EXE 1684 iexplore.exe 1684 iexplore.exe 1772 AcroRd32.exe 1772 AcroRd32.exe 2480 AcroRd32.exe 2480 AcroRd32.exe 1684 iexplore.exe 1684 iexplore.exe 1684 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1112 1684 iexplore.exe 28 PID 1684 wrote to memory of 1112 1684 iexplore.exe 28 PID 1684 wrote to memory of 1112 1684 iexplore.exe 28 PID 1684 wrote to memory of 1112 1684 iexplore.exe 28 PID 1684 wrote to memory of 1672 1684 iexplore.exe 30 PID 1684 wrote to memory of 1672 1684 iexplore.exe 30 PID 1684 wrote to memory of 1672 1684 iexplore.exe 30 PID 1684 wrote to memory of 1672 1684 iexplore.exe 30 PID 2008 wrote to memory of 1992 2008 chrome.exe 32 PID 2008 wrote to memory of 1992 2008 chrome.exe 32 PID 2008 wrote to memory of 1992 2008 chrome.exe 32 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 1500 2008 chrome.exe 33 PID 2008 wrote to memory of 568 2008 chrome.exe 34 PID 2008 wrote to memory of 568 2008 chrome.exe 34 PID 2008 wrote to memory of 568 2008 chrome.exe 34 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35 PID 2008 wrote to memory of 776 2008 chrome.exe 35
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://youtubepi.com1⤵
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:472109 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\listFormats.json2⤵
- Modifies registry class
PID:2656
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\analyze.json2⤵
- Modifies registry class
PID:2176 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\analyze.json"3⤵
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\listFormats (1).json"2⤵
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\listFormats (2).json2⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d44f50,0x7fef6d44f60,0x7fef6d44f702⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:22⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 /prefetch:82⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:12⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:12⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3268 /prefetch:22⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:82⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:82⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:82⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:82⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:12⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4328 /prefetch:82⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:82⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:82⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:82⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 /prefetch:82⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:82⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3808 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3796 /prefetch:82⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:12⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,16839382722318678794,2484535385664042434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=496 /prefetch:82⤵PID:2728
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x53c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD55809c4d315ee0762ce7085f053e0b832
SHA11757da4e4301fcd2ebfca648f9f6a6413e0b9479
SHA256c9ac28c4ba394bb788f9d41a32c925d689d26552392df72e7b6628eb08bb36f7
SHA51251f4a95e9f9af22c35dd0e9821fcda039b674cf14708114401a72f7aab0b76227e91979374191bcc3e82f493456efa0e5ecb8002982e416c3205d87d5a64df88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8
Filesize471B
MD59a4ba4ab27cd47ead09d38283f795198
SHA1cf1d1e13fa427879530cb912e495012a42312b7d
SHA2568c0178a28c92e029ad04c5dbb4b8515117303e64cb3df9f3902a10f151ee1aab
SHA51238430f5c588ec02b07f10f8f3b10fe0e30768ced71d756bc98593021e22200a0558587b69a2f78317b4e9d4f3ed66835df03085aa66014e1672945fc8877357e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1
Filesize471B
MD50a8373bb4c517a184db7e8ae6ac202d2
SHA1ab6c13439aa7f9a46a2407444d3f80e8895b6f46
SHA2568ffd5ad2cebcb95eb36745886fbd643ab4b4f917a7544b548786837a8cb8e6d5
SHA512c648db61e377301075ce99cdd069a69ab2d3c0fbbb9f73309b8aea45294af8dc98287eabe7da7f264d48ccc9eea900206ae9a780abbf66a9600e17b00da9e9d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217D
Filesize472B
MD5b6814de21e79e28c4a59b9bef50020cb
SHA15d6fcbdd6b70933b9367226523ce68364a1f0f1b
SHA25649821c9c4c570ff4e089276c96b05cef53c725e77e34f6c772d2b932e7c81c2d
SHA512d8b4868ea6138221413e3baa4274cf5c1401d615528f68f6c08839dc42855684f43c39fe8e44721845d5c760be0d7793dbba1c76671babb029fe756e67302e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_259154B02A93A7C95A00126214FBE388
Filesize472B
MD566b50d58ebed379dc4f68b02c92f59d2
SHA1635df6d7900149fd2ce567c9d56f14ee71bb2b41
SHA2568092144e087cea4ee21d2a00fa5488225063f57d821ae9fdebe12c4478b08fc5
SHA512cd8cff5e0002c1c4d5da1b4d8414c3dbdd780787daaf6cb98882e740a1004a4c0789434e02b8c601c5135d9d21ec4f0c36f3fe1b2dbf43379564cd835972c4a8
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD584fed7f0e19443bc245f820ad7477c1d
SHA1d8c48b53874bdf5cdb0eea821c47c82f0d6dbab3
SHA2569968863fced01c65eed9b6ebf020307e0b6d980e53551b8259c625ae8c9ec9a7
SHA512a916440a0df98f871da5117c2b0f474bb80bff680090691cb8004b4ec49789e15bc35047549ead99424e3deb61788f21336ca0a783b30632e72629fd15452ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_18CF33A810D0A2D5C0C28C211FE5F3C8
Filesize410B
MD50dbe300c87ba079362aa8ad8a936e163
SHA1503f4a6716c57bc3369e49eebdef8edd9a77a0bd
SHA256ee54aa2ff4e6d369436d68aed2e7b2686247a7f8bad5893d74d56a00886d1370
SHA512a08a91d8c95a922df606e34dd11d5243c43e41e87186988234a2b386e4cd75aebf9ca688b0fcb7bd9c4094944350de13dcd0952989bffe883d04a4754d5ec12f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD507978aba5693a90a4c7ce541f6fc77a9
SHA13b6755a8c54bbe2089ba83b440b6de1eddf4959b
SHA256a593e50cad07a5fd371d6cec85ff9ef2c845aa0ca8b8231a76a578038ebd4820
SHA5125bdc89307b0a52e45cd8ad57f703938519a665d9b4cd984756becfe5cf67df56bdfa1d2d9720da270190f591cd782ff281356ef9fbc4da333d47fbcbd5454955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1
Filesize406B
MD59534f650f791a1634b37befb42ee9e56
SHA1d00fb67b5f78cc44cbca9d457c879d137661c91c
SHA256e5196c5da0022e4a1291c6268d265f746650daa2f6c4a63d924ef7808a4e2e41
SHA5123d37b58b5f1a744a9496981a4e9eb0d89d977da2e802ee22365f092a358f511f4da0792e49a196e561db795ee0a50c54ea78453203675ab4d53e13f5b3066151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_ACA51E1ABBF1573BBD9B48CF6AC4217D
Filesize402B
MD50dbd7fca4f025a22eb4f8e486cd16c93
SHA16901ef5ea16db887febe33b1e25523a832fa3f58
SHA25658f7b9c3ee26e8a8b6f08cd9573465b6498342901fd8a2f8c77a72e32bb3ffdc
SHA512fb67a894fdc740dd5fa48f5a72c26f82a2da5311cd7b07146869da8b76ec0a6ada99bd82e4e6c270fed5c4633297a0e5b05086d0f747d0e1440748a6a0a84d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5c19f07ca9b721ec534711df74da0108a
SHA18b71464495304a6836687b98c1767f2ec5928c5b
SHA2560a201bfc01264fbc14b1139d0204a9d754283df855b3764c886fae9320542306
SHA512ad178f876c977e306e55160c4ebf34bb45f74440b28c9bd39cfd0e2c84972545a6ebe51d2a2181b32676d1fa873df2800181f65d1b8525704ae1d73520430ce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_259154B02A93A7C95A00126214FBE388
Filesize406B
MD584c7c5bd73a52dc3da96bec24e38c90f
SHA14b9da23688f5a81c418f8aecda910d6f6ff37229
SHA25650e996bf156c9ae605988f7a7f34a4f6026314c82c27ebee0c761b216fe90094
SHA5125d03b1d1f3383574188b36f4fa06fcbf2c5035bcbcac10ee8b074075270dbee1761040487de63a842f4b3294eec4ded9ac3c9dbed79c822512a1b6a050dbed37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD590fc673dd970b813db701fb35f02c345
SHA1fbbae8e7d4cdab53e4da38f61645f8d609d94223
SHA2568cbc86a07b9c3116905478ec75b86a2c4367cf4769d664d194607618ee330c43
SHA512dbce6d369fe01cda6cf8d84ef7c427077950d3bfb9f6f0390e92da523284acac0481346d6dd5e951bc9e2fbd75eea303a823218308da2fa7ec18d8f05c879e03
-
Filesize
5KB
MD5f499c16f079502ff860b6b7b6174e2b6
SHA140c34a01e83a32fce130a7043b28959cbdbb234a
SHA2565e99fd48641e4cfc56a45f2d6d0c772c5d70b03e06ce27390c2515234541ede3
SHA512ffecf3531368d66a2efe2001c413dc99c9cb0004391affeec25bb594c75a2ceb55bc74f0d0b056ca05b776ce6e6a9fc7b8547416a6a9a7bbea173881e5b9f17d
-
Filesize
9KB
MD5c979fa9f18e5907a6feeed156b48bffd
SHA1ee234b6b521f5066ac161acf94723fadbcacdf62
SHA256ee18b490ce304dd1960f4a800abcd7f3f1696bea4b3b08ded6818bd5a82aaced
SHA512ac1601729134be9a8da50f3f485c83ee2edbd9a571648b9dafd0da85515da5dfea5bb6fb9906f7a6b411b23e81312d0e8f004b5e761dfd3c6f9271beff8c38ca
-
Filesize
10KB
MD552725ebf7c3d4166beddcb846ef2af83
SHA1e5b12986c610814f6e1bc1f05d0f6a8d1295c181
SHA256b5f350b6b65c348975c3a33858acd0744ff96f3c75fa615150788d6d0909eac1
SHA5127917e71125b2778be4762381d647ea4fbab6e0f994429de18144e9a5c0b2fc81ac44b19308613da4b02db061615de6f194a223b2f18db8dd02c6d43e345d0db1
-
Filesize
177B
MD519935357d38abfed0c2bdae32fe3ac78
SHA1eefdcddbb05b9473eb82efbc4c407958a68b0dcc
SHA256698a6f13098e60d24e559ce2fdcde01b5f1110c8c54229ba2d7718064c428e45
SHA51248f947dafb4ddba1a9c4a9bf636e44d36f9c069896d4263ccbe17f088f19935e0abd5497e30d193f20570ded93dcb6706632cba02bb9654ae6e701fe1500028c
-
Filesize
608B
MD58a23d8979e20e12a550b7713e79cf525
SHA1f52ec1f3f79a2ef09c91ce7c5dee91a10218dc2d
SHA256bb4cc040a6a99da280d357c1d05ae72559cb54018ea24e8fb11876f1c8fc14d1
SHA512d7a07f7f7eb0f53619dd9a56e011464e9e90d98edd75fb08331a9f8285de11e113fb6bce2d704ffc3d0d67bc34f8114eca1653be704b42cdcc0c8bef32622d0f
-
Filesize
573B
MD5f0ed5fd7d7685b5b04ceab8c49e21c1b
SHA1cbee10ce61f39ac131d86b0f6caaf964c536bce2
SHA256a24606a00ec630908de82909ca940ff1d7f29cbb30ee33574938aa8439775778
SHA5123af0f4ba571b5acd66b50392d89d44f72ef39a4ac6a7d38e36cdfcbe1898238798da41a0c9de57caef8555753f93b8852468105d48aed9673278036c2caa40ba
-
Filesize
38B
MD544ee0bd39aa9ef9e9bea327ff3fbdd19
SHA132caf77fe39c8eafaecd9d5efd39e792405cc4ab
SHA2560a678d5248f52e23dfc15bed04f6b5f9270a742cdc21e24b27afa9d9fc228ef9
SHA51294ed7e4b8f2372e9c7354baf83d959ef92ba5b7a67cfbb03a201b74792eb984df61eb61755d6f192ed9e895d0dc4d607aa7f25c56c24130495a8631ea81c7d9c
-
Filesize
3KB
MD5aee5c1cc84c4bb29f06baf02d5d99974
SHA1e4c5180977371f8b7d3e335341114964a33111b3
SHA2560f38a308068e5f2f2f733a7989675bfd9ac43bba3095755d36763f44c0797592
SHA5123927136827f61fc8740964bd136ead914fd5437743b936cc8db88d2462632becc832307f6c4e205a31906954fc19a549df5a39db98aff33f1a7f2543d52b6e1d
-
Filesize
3KB
MD5a6580db3a55d9e0481e060191bde6171
SHA14e921e2c12ed24cf205c09ad93c08ff3e854173a
SHA256a693fb2b785de37bef71d1f6c217623c5876c67ea9064fbafabfb4f02d0eb75b
SHA51273744c6c0fe6603dad760d8b764f7610e6d5bbec25855d61f3582bb6a7b8a849fe130593e0e6687624571f1d32c2beb5bd9b5e2d50eed9a046c328e498eb9edd
-
Filesize
3KB
MD5f2c032e60dad2bed448b1d443aee66dd
SHA1ba12ebdfb9e4a7a408331c629328ff9ad7080952
SHA256ba0b5bc3419f8947cbda9ac7c998ffb376734d49d40d9ffcc0f90b0f19b2841b
SHA5122b13e8f3b2c4ef4f80710011bf0b9405c30fc57d72aba64fe6b722fac00bb4c1e3f4b41d88aedfad7bb1b2301cf2ffcbaece3203a638373b4e771be5727c654d