Analysis
-
max time kernel
110s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 17:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://telegra.ph/Adobe-Photoshop-2023-01-24-4
Resource
win10v2004-20220901-en
General
-
Target
https://telegra.ph/Adobe-Photoshop-2023-01-24-4
Malware Config
Extracted
C:\Program Files\7-Zip\History.txt
Extracted
vidar
2.2
754
https://t.me/litlebey
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
754
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
AppSetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AppSetup.exe -
Executes dropped EXE 3 IoCs
Processes:
7z2201-x64.exe7zFM.exeAppSetup.exepid process 5928 7z2201-x64.exe 5568 7zFM.exe 5600 AppSetup.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
7z2201-x64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
AppSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AppSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AppSetup.exe -
Loads dropped DLL 7 IoCs
Processes:
7zFM.exeInstallUtil.exepid process 3040 3040 5568 7zFM.exe 5568 7zFM.exe 3040 5220 InstallUtil.exe 5220 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
AppSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AppSetup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
AppSetup.exedescription ioc process File opened for modification \??\PhysicalDrive0 AppSetup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
AppSetup.exepid process 5600 AppSetup.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AppSetup.exedescription pid process target process PID 5600 set thread context of 5220 5600 AppSetup.exe InstallUtil.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7z2201-x64.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2201-x64.exe File created C:\Program Files\7-Zip\Lang\sw.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2201-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2201-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5764 4860 WerFault.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 InstallUtil.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString InstallUtil.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1812 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies registry class 23 IoCs
Processes:
7z2201-x64.exechrome.exeOpenWith.exeOpenWith.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2201-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2201-x64.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2201-x64.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2201-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2201-x64.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeInstallUtil.exepid process 2092 chrome.exe 2092 chrome.exe 4920 chrome.exe 4920 chrome.exe 4316 chrome.exe 4316 chrome.exe 2352 chrome.exe 2352 chrome.exe 4552 chrome.exe 4552 chrome.exe 5808 chrome.exe 5808 chrome.exe 5508 chrome.exe 5508 chrome.exe 5388 chrome.exe 5388 chrome.exe 5220 InstallUtil.exe 5220 InstallUtil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid process 5568 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
Processes:
chrome.exepid process 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 5568 7zFM.exe Token: 35 5568 7zFM.exe Token: SeSecurityPrivilege 5568 7zFM.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
Processes:
chrome.exe7zFM.exepid process 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 5568 7zFM.exe 5568 7zFM.exe 5568 7zFM.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe 4920 chrome.exe -
Suspicious use of SetWindowsHookEx 33 IoCs
Processes:
OpenWith.exe7z2201-x64.exeOpenWith.exepid process 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 4120 OpenWith.exe 5928 7z2201-x64.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe 3776 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4920 wrote to memory of 4964 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4964 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 3700 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 2092 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 2092 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe PID 4920 wrote to memory of 4796 4920 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://telegra.ph/Adobe-Photoshop-2023-01-24-41⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff94a624f50,0x7ff94a624f60,0x7ff94a624f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6080 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6436 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7868 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8076 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9032 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4800 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6504 /prefetch:82⤵
-
C:\Users\Admin\Downloads\7z2201-x64.exe"C:\Users\Admin\Downloads\7z2201-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=812 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,2053757143532404578,758341000751409816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7760 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4860 -ip 48601⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4860 -s 7761⤵
- Program crash
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Adobe Photoshop 2023.rar"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\AppSetup.exe"C:\Users\Admin\Desktop\AppSetup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip.dllFilesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
C:\Program Files\7-Zip\7-zip.dllFilesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
C:\Program Files\7-Zip\7-zip.dllFilesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
C:\Program Files\7-Zip\7-zip.dllFilesize
92KB
MD5c3af132ea025d289ab4841fc00bb74af
SHA10a9973d5234cc55b8b97bbb82c722b910c71cbaf
SHA25656b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52
SHA512707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2
-
C:\Program Files\7-Zip\7z.dllFilesize
1.7MB
MD5bbf51226a8670475f283a2d57460d46c
SHA16388883ced0ce14ede20c7798338673ff8d6204a
SHA25673578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
-
C:\Program Files\7-Zip\7z.dllFilesize
1.7MB
MD5bbf51226a8670475f283a2d57460d46c
SHA16388883ced0ce14ede20c7798338673ff8d6204a
SHA25673578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
-
C:\Program Files\7-Zip\7zFM.exeFilesize
935KB
MD5d36deceeb4c9645aab2ded86608d090b
SHA1912f4658c4b046fbadd084912f9126cb1ae3737b
SHA256018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45
SHA5129752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Downloads\7z2201-x64.exeFilesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
C:\Users\Admin\Downloads\7z2201-x64.exeFilesize
1.5MB
MD5a6a0f7c173094f8dafef996157751ecf
SHA1c0dcae7c4c80be25661d22400466b4ea074fc580
SHA256b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4
SHA512965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94
-
C:\Users\Admin\Downloads\Adobe Photoshop 2023.rarFilesize
5.6MB
MD5469cef40c7b0d33b58350f8f85f4f9c1
SHA177965fe37e14e6a1512f90be9f4ae405c47ce117
SHA256d19349d59803f106225124147a68b85f4a7557e01741f2295d37b6b42bfaba3b
SHA512f2384c1e76147462f51d7008f725772ff92777b1afed5cb50ee159de99b4b8978ef042513d02f3ddf27915ae39d342a792043b4b76182cabf8bb5bb298180300
-
\??\pipe\crashpad_4920_VXMHNRYTOCLUMQNCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1812-181-0x0000000000000000-mapping.dmp
-
memory/5220-155-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5220-178-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5220-180-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5220-159-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/5220-151-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5220-152-0x000000000042D1BC-mapping.dmp
-
memory/5220-153-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5220-154-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5352-179-0x0000000000000000-mapping.dmp
-
memory/5600-145-0x0000000000390000-0x0000000001302000-memory.dmpFilesize
15.4MB
-
memory/5600-156-0x0000000000390000-0x0000000001302000-memory.dmpFilesize
15.4MB
-
memory/5600-157-0x00007FF967790000-0x00007FF967985000-memory.dmpFilesize
2.0MB
-
memory/5600-158-0x00007FF944080000-0x00007FF944B41000-memory.dmpFilesize
10.8MB
-
memory/5600-150-0x00007FF944080000-0x00007FF944B41000-memory.dmpFilesize
10.8MB
-
memory/5600-146-0x00007FF967790000-0x00007FF967985000-memory.dmpFilesize
2.0MB
-
memory/5600-149-0x0000000000390000-0x0000000001302000-memory.dmpFilesize
15.4MB
-
memory/5928-133-0x0000000000000000-mapping.dmp