5866804afc84a2b13816aa2256fded91ac7f75dda61a61d35e2f1c73d82bb7c9

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/02/2023, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cantar de mio cid.webp
Size

14KB
MD5

7a4a95e572623b834ba5ed67175fd645
SHA1

3168319fbecd708bdffeffd38369367e54b92646
SHA256

5866804afc84a2b13816aa2256fded91ac7f75dda61a61d35e2f1c73d82bb7c9
SHA512

f8e185f0e5d4624645ff2ed572b1f87b39aa3b838ec7822795a391e0cb0ed6e4ed25c976cde04969e245ee28cad978a0e474bd702762f5abdd622d851a36a0b9
SSDEEP

384:E/Ybsyjnc+MYiP077cf0j/GGWldB1oe+eNUf:jjnc+j/cf0jOGoB1oe+2K

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	chrome.exe
472	chrome.exe
472	chrome.exe
2912	chrome.exe
2920	chrome.exe
2572	chrome.exe
472	chrome.exe
2380	chrome.exe
472	chrome.exe
472	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1448	AUDIODG.EXE
Token: 33	1448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1448	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe
472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 472	1508	cmd.exe	29
PID 1508 wrote to memory of 472	1508	cmd.exe	29
PID 1508 wrote to memory of 472	1508	cmd.exe	29
PID 472 wrote to memory of 1688	472	chrome.exe	30
PID 472 wrote to memory of 1688	472	chrome.exe	30
PID 472 wrote to memory of 1688	472	chrome.exe	30
PID 868 wrote to memory of 732	868	chrome.exe	32
PID 868 wrote to memory of 732	868	chrome.exe	32
PID 868 wrote to memory of 732	868	chrome.exe	32
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1748	472	chrome.exe	34
PID 472 wrote to memory of 1004	472	chrome.exe	33
PID 472 wrote to memory of 1004	472	chrome.exe	33
PID 472 wrote to memory of 1004	472	chrome.exe	33
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35
PID 472 wrote to memory of 1996	472	chrome.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cantar de mio cid.webp"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cantar de mio cid.webp
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6794f50,0x7fef6794f60,0x7fef6794f70
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1076 /prefetch:2
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1808 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3568 /prefetch:2
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:2116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3828 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:8
    3⤵
    PID:2272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3956 /prefetch:8
    3⤵
    PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4236 /prefetch:8
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:8
    3⤵
    PID:2380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    PID:2492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:8
    3⤵
    PID:2612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
    3⤵
    PID:2636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:8
    3⤵
    PID:3052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3764 /prefetch:8
    3⤵
    PID:1404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:2288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:2284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:2456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:8
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:8
    3⤵
    PID:2664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:8
    3⤵
    PID:2764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=620 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,13858848383184035733,13290182883128965851,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6794f50,0x7fef6794f60,0x7fef6794f70
  2⤵
  PID:732

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e2bef241a62ab33280f991285ff2da5a

SHA1
14b6eca7e1ba753b1922dcdc32fe7e564b81f4d9

SHA256
0ec0fa954061b903ef702d74e6a9622baf6e325a80403d5f21dce2b7cf368fb6

SHA512
7ab359d434979331bb2c77d9370cb8ef7a707aaaddf4ff908a5e10b8f777c989ef02891e32eeb842f745d2d2096d8dfa3ece5fcbee63c6c1d4b4a060cbdae0aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e2bef241a62ab33280f991285ff2da5a

SHA1
14b6eca7e1ba753b1922dcdc32fe7e564b81f4d9

SHA256
0ec0fa954061b903ef702d74e6a9622baf6e325a80403d5f21dce2b7cf368fb6

SHA512
7ab359d434979331bb2c77d9370cb8ef7a707aaaddf4ff908a5e10b8f777c989ef02891e32eeb842f745d2d2096d8dfa3ece5fcbee63c6c1d4b4a060cbdae0aa

Download Submit
memory/1508-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download