Analysis
-
max time kernel
297s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-02-2023 12:31
General
-
Target
0A5556BE9428BB753FC53893A582FD42183762F198D83.exe
-
Size
47KB
-
MD5
725e1c369fb346eb8313e17fe8f7e328
-
SHA1
fbcdaa9b245834d26353b9ad10d26d180c696ac0
-
SHA256
0a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
-
SHA512
78676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
SSDEEP
768:4oFKMJMj5I4G3y/Nu8+7lnu1c3fT89VnbC53tjbfgr3iAvj29nnmfJ7ClZF2tYch:4oFKMJeYBn6c3fT6i3lborScYnmfErF
Malware Config
Extracted
asyncrat
0.5.6D
Default
seznam.zapto.org:6606
seznam.zapto.org:7707
seznam.zapto.org:8808
milla11.publicvm.com:6606
milla11.publicvm.com:7707
milla11.publicvm.com:8808
trffisyuiifgqcpeof
-
delay
6
-
install
true
-
install_file
explorere.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4660-132-0x0000000000AA0000-0x0000000000AB2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat C:\Users\Admin\AppData\Roaming\explorere.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe -
Executes dropped EXE 2 IoCs
Processes:
explorere.exeChromeRecovery.exepid process 3796 explorere.exe 3308 ChromeRecovery.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecovery.exe elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4452 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exetaskmgr.exepid process 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2724 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe 2184 chrome.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.exetaskmgr.exeexplorere.exedescription pid process Token: SeDebugPrivilege 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe Token: SeDebugPrivilege 2724 taskmgr.exe Token: SeSystemProfilePrivilege 2724 taskmgr.exe Token: SeCreateGlobalPrivilege 2724 taskmgr.exe Token: SeDebugPrivilege 3796 explorere.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe 2724 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0A5556BE9428BB753FC53893A582FD42183762F198D83.execmd.execmd.exechrome.exedescription pid process target process PID 4660 wrote to memory of 2952 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4660 wrote to memory of 2952 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4660 wrote to memory of 2188 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 4660 wrote to memory of 2188 4660 0A5556BE9428BB753FC53893A582FD42183762F198D83.exe cmd.exe PID 2952 wrote to memory of 1208 2952 cmd.exe schtasks.exe PID 2952 wrote to memory of 1208 2952 cmd.exe schtasks.exe PID 2188 wrote to memory of 4452 2188 cmd.exe timeout.exe PID 2188 wrote to memory of 4452 2188 cmd.exe timeout.exe PID 2188 wrote to memory of 3796 2188 cmd.exe explorere.exe PID 2188 wrote to memory of 3796 2188 cmd.exe explorere.exe PID 2184 wrote to memory of 5108 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 5108 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2560 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2464 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 2464 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe PID 2184 wrote to memory of 1316 2184 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"C:\Users\Admin\AppData\Local\Temp\0A5556BE9428BB753FC53893A582FD42183762F198D83.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /ru system /rl highest /tn 0A5556BE9428BB753FC53893A582FD42183762F198D83 /tr '"C:\Users\Admin\AppData\Roaming\explorere.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB77D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\explorere.exe"C:\Users\Admin\AppData\Roaming\explorere.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa3674f50,0x7ffaa3674f60,0x7ffaa3674f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2004 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4460 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5340 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2352 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2332613542869448114,10688934538684174634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={2da08f85-80b9-423d-a1c9-d71eb8fbb1a3} --system2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir4196_693826099\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Temp\tmpB77D.tmp.batFilesize
153B
MD54e9c323b90aa099e9fd9261b1eb176c7
SHA14e37b4e4a31df17d7c6869786b4c027166076ab8
SHA25606610a481c0b27e87f4fc2edb4bce506510ddc497acba5850330cf08e623e1ec
SHA51243d1e270d4be7bc1afbad391ada30ca746b5d180b9c2ebd61f41c7349796ba4069a2cee5ebeed873f96ed214ae17a45edeb54b26aa357d54ee200cfa52d12c63
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
C:\Users\Admin\AppData\Roaming\explorere.exeFilesize
47KB
MD5725e1c369fb346eb8313e17fe8f7e328
SHA1fbcdaa9b245834d26353b9ad10d26d180c696ac0
SHA2560a5556be9428bb753fc53893a582fd42183762f198d830672666c706af6d6d78
SHA51278676eb4182594c84c7e3a14b898fe0241eddd8a4ddfae2e154ee04c1a41773a92b1363c4aa3b2e42cb0871885864573038219526de32ae0352ae6858633c20e
-
\??\c:\program files\google\chrome\chromerecovery\scoped_dir4196_693826099\chromerecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
\??\pipe\crashpad_2184_RICNWHHUETJIDIPZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1208-136-0x0000000000000000-mapping.dmp
-
memory/2188-135-0x0000000000000000-mapping.dmp
-
memory/2952-134-0x0000000000000000-mapping.dmp
-
memory/3308-147-0x0000000000000000-mapping.dmp
-
memory/3796-140-0x0000000000000000-mapping.dmp
-
memory/3796-143-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/3796-144-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/4452-139-0x0000000000000000-mapping.dmp
-
memory/4660-138-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/4660-132-0x0000000000AA0000-0x0000000000AB2000-memory.dmpFilesize
72KB
-
memory/4660-133-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB