hxxps://discordapp[.]com/ra/DTJRDv-wLnT68qcxz8UWv7hRwmNO9uH5S2DKf_-DonY

Resubmissions

14-01-2023 04:31

230114-e5ekpsdg41 6

14-01-2023 04:26

230114-e2yjeahh36 6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
14-01-2023 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discordapp.com/ra/DTJRDv-wLnT68qcxz8UWv7hRwmNO9uH5S2DKf_-DonY

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "98"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "153"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{150F90EB-93CC-11ED-98FA-7AFE47082869} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "153"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "153"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "213"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "98"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "305"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "305"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "8"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{150F90ED-93CC-11ED-98FA-7AFE47082869}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "265"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "98"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "213"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "213"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\ = "265"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\Total = "265"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "305"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
8	chrome.exe
8	chrome.exe
4512	chrome.exe
4512	chrome.exe
60	chrome.exe
60	chrome.exe
1596	chrome.exe
1596	chrome.exe
3388	chrome.exe
3388	chrome.exe
2500	chrome.exe
2500	chrome.exe
3916	chrome.exe
3916	chrome.exe
4876	chrome.exe
4876	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe
816	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
624	Process not Found
624	Process not Found
624	Process not Found
624	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4248	iexplore.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4248	iexplore.exe
4248	iexplore.exe
1976	IEXPLORE.EXE
1976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1976	4248	iexplore.exe	66
PID 4248 wrote to memory of 1976	4248	iexplore.exe	66
PID 4248 wrote to memory of 1976	4248	iexplore.exe	66
PID 4512 wrote to memory of 1472	4512	chrome.exe	70
PID 4512 wrote to memory of 1472	4512	chrome.exe	70
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 2120	4512	chrome.exe	71
PID 4512 wrote to memory of 8	4512	chrome.exe	72
PID 4512 wrote to memory of 8	4512	chrome.exe	72
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73
PID 4512 wrote to memory of 4516	4512	chrome.exe	73

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://discordapp.com/ra/DTJRDv-wLnT68qcxz8UWv7hRwmNO9uH5S2DKf_-DonY
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb27534f50,0x7ffb27534f60,0x7ffb27534f70
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1440,13728817821495197674,10204605713633819230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
196169502c70daf0e790956bc9394295

SHA1
2c8613534f7b6d0c36fd3a00f63030c143bb9ecf

SHA256
d91a76a51556933d4357a18d043025b46b2f5821147e518b46992289784c813e

SHA512
f942885764c640fc5b7432bf99eb9df9ce738160ff3bb1ae9fa09fe805eb24b6b9a1a049e77162551f5cd7122ec6042a14a18070e5f8dd78691d2cf95891784c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_0CFE8859785D20D1C400BE4780B399B8

Filesize
471B

MD5
8590d38785fdeea0db21ef8471d10dde

SHA1
95b4246de5742cf6c3326fa28d409a766dfa00fe

SHA256
6bd870aa04e6a4359c7894bd60e7f509e8c2683a370b2f6fd1c6b028051236f5

SHA512
cc571b36f53f5caf393ef8c3008b2de05dbc6c18cf155f27bd30ba5dcfc4f26deb342216b6b279e4afb046772c4f3a9f1f1ab663d10f6151f53c97cbe61813ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
bdceac2a60b8b7f88ec2be529f4226c6

SHA1
00c8ff46ee13997c895be05d7a2b08604f8c91b5

SHA256
08b7e710bfcb2c0a5681c1dc06c018c0f25312163bdc4992049158ba0e486458

SHA512
c831e741413c6734d99985be8073e793816bdab00786c94e2b2b4791d28727691a444dd3cce16851ab5f4d193181d07a00188f36a47847caa2047e09a6d1c72f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_90B77F4A11E5ADF5202CC3D8C5DC4FBA

Filesize
472B

MD5
c16b1530bbcd3d9226362c0a6100f014

SHA1
a49685aa2869a3674bc4c8fc58acd47f655c2111

SHA256
ff063e27670433897ba82fdf8048fc228587ab2f01c21e2970f03b3df9093539

SHA512
330d8f65d4fa6d1a7cf05fe9906ed639569ef95d099e4d4e780fe811d138b7efeca26e980183a3e148211b7b1bc0b0c41b38c838bd44d08ece2aadcc590e42f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1

Filesize
471B

MD5
b5628887325331ad3d660f7208e1995c

SHA1
9e4bf04468a7aed126488ccb5552a8e02610f6dd

SHA256
5cd181d6728fc5f0f4d88407b97af61db39c5a38feebdeb2c21335cf4402fca4

SHA512
17a30f79d58a7c801830d19f98d07e224a5826daba295b23ea2af984d185bd0bcae8c3e3ea08e68016d8c5ded12137a79e6ba59106bbe11b314ac564d867b454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
471B

MD5
6b88e1e04271c955f9e7fcb0d8dddeaf

SHA1
2cdc9b22b7fa272c4013287e1c03ba3e33851cf8

SHA256
f03ac063531825e6339a540ca8fac7cf76a5312513bee8bc2c93ab6e5f611763

SHA512
4308f23bc2964d33b727d5dc067992684fb06380e5e21a13c8ca78874dba8954d4c759728e0f863e1c07b42e81c1f520e5a1e922ad7459c6912d22514eddc32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
9048ad29521fe4361e724e0331643fdd

SHA1
c7f57815d0d7fabb9700c4ea36861032047f1f79

SHA256
970b06deda55f3eda265cdd7f698b604d0226aabdd5d3c8ee68eb8f93cc692f2

SHA512
a147905dbd00b5270ba48e62ef82bea130233338c77d0461bc40ff11eaa71463e08bd54b19d464eb10744210ae0972d791774849983f4e382493f624b364f7b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_0CFE8859785D20D1C400BE4780B399B8

Filesize
408B

MD5
f82d6a9555c44e26a6d00fe66a017946

SHA1
395bda2ea98f9f4a463bea8868ef025fc323bbf5

SHA256
6cf9d12bbae4002a11b122d5966105f4780317732560cecfe400e253967e227c

SHA512
e012aa7d75db0bb336eba2131e437813d08385e36bdb386fa0e0e40a80a2f57803c5b30bbec9845d79df47cfff4c0c971bf656915a637212af45b074c296703a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
3eb7fc0ccc29791067e37595dd30d2ce

SHA1
b4655d90b5a00580e328d9909ee42bfe992e80d7

SHA256
c17d10804342ec4d78c57b0ef2eaf06ca392eeecc533def8b8ee5401e0c237af

SHA512
402e86daf719ecaaaa87484b0032be6364a5ea8e85475d57c9a680ab5b3edced013d1cbb78244d86e6477dabf7c659d782b832a7d3ee21cfe235b53986195307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_90B77F4A11E5ADF5202CC3D8C5DC4FBA

Filesize
406B

MD5
317ad63784077b599bdf7d14dbcbcd6b

SHA1
b39f8c8c3ee9bcae364e64777137049c911ae2d9

SHA256
384d5e2652c2559e67b6a4ddd872b564cfcdb7422ced6fb835cc6ea2e2acf1f8

SHA512
069965a6d4373f4d0c37957264f44e2fb3c36fe726f1dee0d68f5f794b3fb4b68f981a36bb6206d7bce01d0d4e5199438c5cb731b247a5fcabe919dad6234d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1

Filesize
406B

MD5
4d6f4628f2d1ea460dedab175a91c0ab

SHA1
ab9cf0caf80dfa42aa333509bf69b6522323abb7

SHA256
0b88fb087310b0fee0337f477fde7ef6ddc78637dbc762106633834fc169c815

SHA512
675bca980c8db1a9999bf7c1a74cef50e51e194755c832e0b3859cccceb24926c22edf195eb926af479dd07dd472fc00b04ba033a4efe70a7a847b88fa722b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
b2917e6395a3b46275d9c39bbd82f384

SHA1
9a10d986e6909b1bae3b1cadedcbd7575c509900

SHA256
a4726b5e9a9e4e989e1aecc697f399b398ce7482f18a736cc69b193ff402cff8

SHA512
a0dec2d0ce6684da68e52fe48998cadba1a2cafb21516beb0f3d3c2e162600217db5931e4c7712d1d70b50664aad6addf5c74dceb7d373ec851d57e271ecfb46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

Filesize
396B

MD5
1af090e822c26086992314686cdda647

SHA1
87d1adbb7a2c8bf53ab5aa92b98579a43af05d06

SHA256
eefc06837ba29074604e08b021d3d9b816564b8f7e5a7238a3504b039660b1ca

SHA512
4b9382037a1a9f8c2b1afbb541f3e8cf83b3040e04ca90da7aec738797a6484af5a513d866ded137b680a4daef3b8bfb60cd7c8b32023fee29b2cf3810a0b319

Download Submit