Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-es -
resource tags
arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
31/01/2023, 21:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/a7l5m0q4oyf4dbs/Pack-4ndrea.VP.rar/file
Resource
win10v2004-20221111-es
General
-
Target
https://www.mediafire.com/file/a7l5m0q4oyf4dbs/Pack-4ndrea.VP.rar/file
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1696 winrar-x64-620.exe 3564 uninstall.exe 5028 WinRAR.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation winrar-x64-620.exe -
Loads dropped DLL 1 IoCs
pid Process 2392 Process not Found -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-620.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_7.jpg chrome.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-620.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea.jpg chrome.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-620.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExt.dll winrar-x64-620.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_1.jpg chrome.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-620.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_2.jpg chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_6.jpg chrome.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-620.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-620.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-620.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-620.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-620.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-620.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-620.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-620.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_3.jpg chrome.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-620.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240606328 winrar-x64-620.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-620.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\Pack-4ndrea_5.jpg chrome.exe File opened for modification C:\Program Files\WinRAR winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-620.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Pack-4ndrea.VP\_.011 VPC.jpg chrome.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-620.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-620.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-620.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-620.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r11 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r25 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r04 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r14\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r07 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r26 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r10 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r19 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arj uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r07\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r20 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xxe uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR uninstall.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 428 chrome.exe 428 chrome.exe 1732 chrome.exe 1732 chrome.exe 4560 chrome.exe 4560 chrome.exe 4556 chrome.exe 4556 chrome.exe 1652 chrome.exe 1652 chrome.exe 3728 chrome.exe 3728 chrome.exe 3664 chrome.exe 3664 chrome.exe 2980 chrome.exe 2980 chrome.exe 2536 chrome.exe 2536 chrome.exe 3048 chrome.exe 3048 chrome.exe 5300 mspaint.exe 5300 mspaint.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 5028 WinRAR.exe 5028 WinRAR.exe 5028 WinRAR.exe 5028 WinRAR.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe 1732 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1696 winrar-x64-620.exe 1696 winrar-x64-620.exe 1696 winrar-x64-620.exe 3564 uninstall.exe 5300 mspaint.exe 5420 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2208 1732 chrome.exe 82 PID 1732 wrote to memory of 2208 1732 chrome.exe 82 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 376 1732 chrome.exe 85 PID 1732 wrote to memory of 428 1732 chrome.exe 86 PID 1732 wrote to memory of 428 1732 chrome.exe 86 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87 PID 1732 wrote to memory of 1064 1732 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.mediafire.com/file/a7l5m0q4oyf4dbs/Pack-4ndrea.VP.rar/file1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd37c14f50,0x7ffd37c14f60,0x7ffd37c14f702⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:22⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:82⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:12⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6244 /prefetch:82⤵
- Drops file in Program Files directory
PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:12⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6856 /prefetch:82⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7124 /prefetch:82⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7132 /prefetch:82⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7036 /prefetch:82⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:12⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:12⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7192 /prefetch:82⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7280 /prefetch:82⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6932 /prefetch:82⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6964 /prefetch:82⤵PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:12⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6012 /prefetch:82⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5924 /prefetch:82⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:3212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1564 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:12⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:12⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Users\Admin\Downloads\winrar-x64-620.exe"C:\Users\Admin\Downloads\winrar-x64-620.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1696 -
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3564
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7748 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1564 /prefetch:12⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:12⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:12⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:12⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,13103366789822886655,17927259223532186788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:5500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:308
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1800
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Downloads\Pack-4ndrea.VP.rar" C:\Users\Admin\Downloads\1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5028
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Pack-4ndrea.VP\Pack-4ndrea.jpg" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5300
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:5356
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5420
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5e8943094a7a6e3a6767e8d412fdbc8c3
SHA17e7eac16f0741a747639a131cf8e93e63c7e9d7c
SHA25635c7deb1cf472f4d695ab0def305234629440236a8e9422fa8860c362ffe35bd
SHA512dda86c6f7ad30bf7dfb7d2d8584f0956018b7425837129d6c9de3c126a9ec48bda8b761bd6084031f0daaa22393af901820a9f2cce1a049944db27705da1209b
-
Filesize
659KB
MD5ea4678249e28226ffc839a9a20874857
SHA193b411700f6d438de5539b5f541f400eaad258cd
SHA256ff80b23750347fcdf4b54a4deb794ea5c84ee6accd9f988be0dc68a9eaef4d9d
SHA51271089979244259ff9b18de256aa2b37614fce49f00b518386aa0562c5d5a1b7f9135500a452989ad7fb7571afff6873bd10166522cbe3a99dca307111bcec258
-
Filesize
437KB
MD54b666387a3c9dcff1a35f928003906f8
SHA1afdcb15eb059fa09acc0f0ac7745a5c9b6325cf6
SHA256882dc7d4df95d06de571b475f50472639d62298b7da2bb78cd35f462d815fe92
SHA51260c26cea6eff640b116e98f8e8a6d6de00e6fe6cc379768574c5a8e1df95a6cf6bf37e2f56d040cca537a3406e2af05888a63c5b167ca25b16518808c3a5574e
-
Filesize
102KB
MD5009a59803c14130cfb6ef5b1fc8b2bce
SHA11842d01ecd0bfaf5db6c89d17458ba9cac8d0cf1
SHA25686491ffa4415b525dd4f51f3806b5217c5fdbaeee83ac313e28ed342bde83ff5
SHA512a67aa1d6ccfce38314d488fa20469b05f84cf5cb5bdd089b7c28349b64bc359954fccfea7eb574eb3eeb7eec4b6d7f07f334c6be96d14ea301b7706d168ed3d3
-
Filesize
317KB
MD579f52d2a3c76f7402de3e30b2dc9bc7e
SHA1bb15a3289e308295891b3078190e8d797a52acf2
SHA2564e4db98a555a3821e911bc35c301fd4dab8530cf9fede6f6c9439e212919abda
SHA51273b09d5db6ca8587ec8f5b7a0bd711a9225561116d90ae7609442bd388110eebb075a5862bb1abae54f8c32cb880e27d741dbecdba2cb9b2c10c5ef7b1a2685b
-
Filesize
2.4MB
MD5f01b85893ccecbb9020d065e47e046aa
SHA1237311f4c143f74758a8ef6aeeeff0b9dcfe1434
SHA256821588b7db1e9a4ddcf4a53435334370e57cd4663a6f4f2aa570e5850432ca42
SHA5125f821880075570b6f1fa5bdf231d46b4e64dd44e2b122cd7c6ef6ed007e9bf23e33e1abef6eef1ef3a9eb63940bc8eb63cc0daa5a2e85062dbb4f2292d59c835
-
Filesize
437KB
MD54b666387a3c9dcff1a35f928003906f8
SHA1afdcb15eb059fa09acc0f0ac7745a5c9b6325cf6
SHA256882dc7d4df95d06de571b475f50472639d62298b7da2bb78cd35f462d815fe92
SHA51260c26cea6eff640b116e98f8e8a6d6de00e6fe6cc379768574c5a8e1df95a6cf6bf37e2f56d040cca537a3406e2af05888a63c5b167ca25b16518808c3a5574e
-
Filesize
3.4MB
MD573414a9b8498d43b9a195dac57871203
SHA13e59209a7855955c7ca7500adf43e9c17b9a4568
SHA2564b153e952d823b2126d3efba4f8a1353642645e00be93ab49f603d9e924c800e
SHA512cb7dbfef452ff3da6207afea59ba77f0790756ea87a690d08cad32f27feaa78aa47196eeb9e7ae78ac3690bdf2195fca06a5b96c4614ca350803d70e743e5017
-
Filesize
3.4MB
MD573414a9b8498d43b9a195dac57871203
SHA13e59209a7855955c7ca7500adf43e9c17b9a4568
SHA2564b153e952d823b2126d3efba4f8a1353642645e00be93ab49f603d9e924c800e
SHA512cb7dbfef452ff3da6207afea59ba77f0790756ea87a690d08cad32f27feaa78aa47196eeb9e7ae78ac3690bdf2195fca06a5b96c4614ca350803d70e743e5017