Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2023 20:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://firebasestorage.googleapis.com/v0/b/cobalt-nomad-372419.appspot.com/o/OwSq1IMH1D%2FDocument_224_Copy_01-12.zip?alt=media&token=aa49349f-ed98-456b-85c4-ce74daf4a0e3
Resource
win10v2004-20221111-en
General
-
Target
https://firebasestorage.googleapis.com/v0/b/cobalt-nomad-372419.appspot.com/o/OwSq1IMH1D%2FDocument_224_Copy_01-12.zip?alt=media&token=aa49349f-ed98-456b-85c4-ce74daf4a0e3
Malware Config
Extracted
icedid
1387823457
allertmnemonkik.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 94 4924 rundll32.exe 98 4924 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4924 rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.exedescription ioc process File opened (read-only) \??\E: cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 3 IoCs
Processes:
chrome.exe7zG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zG.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7zG.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exerundll32.exechrome.exepid process 1392 chrome.exe 1392 chrome.exe 960 chrome.exe 960 chrome.exe 940 chrome.exe 940 chrome.exe 2768 chrome.exe 2768 chrome.exe 3628 chrome.exe 3628 chrome.exe 3612 chrome.exe 3612 chrome.exe 2152 chrome.exe 2152 chrome.exe 3376 chrome.exe 3376 chrome.exe 4924 rundll32.exe 4924 rundll32.exe 3812 chrome.exe 3812 chrome.exe 3812 chrome.exe 3812 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zG.exepid process 872 7zG.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 960 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7zG.exedescription pid process Token: SeRestorePrivilege 872 7zG.exe Token: 35 872 7zG.exe Token: SeSecurityPrivilege 872 7zG.exe Token: SeSecurityPrivilege 872 7zG.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
chrome.exe7zG.exepid process 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 872 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 960 wrote to memory of 4412 960 chrome.exe chrome.exe PID 960 wrote to memory of 4412 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1584 960 chrome.exe chrome.exe PID 960 wrote to memory of 1392 960 chrome.exe chrome.exe PID 960 wrote to memory of 1392 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe PID 960 wrote to memory of 2252 960 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://firebasestorage.googleapis.com/v0/b/cobalt-nomad-372419.appspot.com/o/OwSq1IMH1D%2FDocument_224_Copy_01-12.zip?alt=media&token=aa49349f-ed98-456b-85c4-ce74daf4a0e31⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa24414f50,0x7ffa24414f60,0x7ffa24414f702⤵PID:4412
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:22⤵PID:1584
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:2252
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:12⤵PID:4592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:12⤵PID:4052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4284 /prefetch:82⤵PID:3572
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:1920
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:3264
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:4468
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3644 /prefetch:82⤵PID:520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:2348
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:4944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=824 /prefetch:82⤵PID:2576
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5712 /prefetch:82⤵PID:3624
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:2748
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:82⤵PID:3480
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5716 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3812 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1648,4536479531882968605,12911685456867421013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 /prefetch:82⤵PID:3768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:424
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3124
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Document_224_Copy_01-12\" -ad -an -ai#7zMap9675:108:7zEvent220461⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:872
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c negconrodl\bogpacsipr.cmd A B C D E F G H I J K L M N O P K R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 91⤵
- Enumerates connected drives
PID:372 -
C:\Windows\system32\xcopy.exexcopy /s /i /e /h negconrodl\outgoing.dat C:\Users\Admin\AppData\Local\Temp\*2⤵PID:4704
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\outgoing.dat,init2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4924
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\outgoing.datFilesize
189KB
MD5c9f3dd6dddcd3beb7070d9f915219034
SHA1c3f080523dc1b8c444742f372b9d212743b8a503
SHA25665281fe83e22bde20fa56079bebaea6fb353d1036be8073924fdf64cd9194984
SHA51241c4bc71788b5c48cdce3337f281c886c38cef0d139bdaa7d90250418df7582663ccc298c04b8e52c0d5f4da1ecd34fb82dd424aacc67d8559bfdc2e2caf160b
-
C:\Users\Admin\AppData\Local\Temp\outgoing.datFilesize
189KB
MD5c9f3dd6dddcd3beb7070d9f915219034
SHA1c3f080523dc1b8c444742f372b9d212743b8a503
SHA25665281fe83e22bde20fa56079bebaea6fb353d1036be8073924fdf64cd9194984
SHA51241c4bc71788b5c48cdce3337f281c886c38cef0d139bdaa7d90250418df7582663ccc298c04b8e52c0d5f4da1ecd34fb82dd424aacc67d8559bfdc2e2caf160b
-
C:\Users\Admin\Downloads\Document_224_Copy_01-12.zipFilesize
108KB
MD5997db94d3f5a2e20375fea4a17b5b6b1
SHA1f014d89d1c5c9d7851b962c031cd07a9c31b2270
SHA256fbeffaaf34d13cd45e2e545172db2287fead4ed05c04c0e8da549a0869d2fa96
SHA512b40975145771794028d5c801742d94352541f1b38f40bec3d0c2afa5350c48000073d75862b571de2756e6cada53686a59f35a1211668e64b86771adb668382e
-
\??\pipe\crashpad_960_ZPEQCCGGTNQFSWEOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4704-135-0x0000000000000000-mapping.dmp
-
memory/4924-136-0x0000000000000000-mapping.dmp
-
memory/4924-139-0x00000235B3620000-0x00000235B3629000-memory.dmpFilesize
36KB