hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
119s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

bootkit persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

[email protected]

description ioc process

File opened for modification \??\PhysicalDrive0 [email protected]

description	ioc	process
File opened for modification	\??\PhysicalDrive0	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248844880904708"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exe[email protected][email protected][email protected][email protected][email protected]

pid	process
4244	chrome.exe
4244	chrome.exe
728	[email protected]
728	[email protected]
728	[email protected]
728	[email protected]
2920	[email protected]
2920	[email protected]
5060	[email protected]
1252	[email protected]
1252	[email protected]
5060	[email protected]
2920	[email protected]
4092	[email protected]
4092	[email protected]
2920	[email protected]
728	[email protected]
728	[email protected]
2920	[email protected]
2920	[email protected]
4092	[email protected]
4092	[email protected]
5060	[email protected]
5060	[email protected]
1252	[email protected]
1252	[email protected]
728	[email protected]
728	[email protected]
1252	[email protected]
1252	[email protected]
5060	[email protected]
5060	[email protected]
4092	[email protected]
4092	[email protected]
2920	[email protected]
2920	[email protected]
2920	[email protected]
2920	[email protected]
4092	[email protected]
4092	[email protected]
5060	[email protected]
5060	[email protected]
1252	[email protected]
1252	[email protected]
728	[email protected]
728	[email protected]
1252	[email protected]
4092	[email protected]
4092	[email protected]
1252	[email protected]
2920	[email protected]
2920	[email protected]
5060	[email protected]
5060	[email protected]
728	[email protected]
728	[email protected]
4092	[email protected]
4092	[email protected]
1252	[email protected]
5060	[email protected]
1252	[email protected]
5060	[email protected]
2920	[email protected]
2920	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4244 chrome.exe
4244 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe
Token: SeShutdownPrivilege	4244	chrome.exe
Token: SeCreatePagefilePrivilege	4244	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe

Suspicious use of SendNotifyMessage 50 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
4244	chrome.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

[email protected][email protected][email protected][email protected][email protected][email protected][email protected]

pid	process
1872	[email protected]
728	[email protected]
2920	[email protected]
4092	[email protected]
1252	[email protected]
5060	[email protected]
1012	[email protected]
2920	[email protected]
1252	[email protected]
728	[email protected]
5060	[email protected]
728	[email protected]
2920	[email protected]
1252	[email protected]
5060	[email protected]
728	[email protected]
1252	[email protected]
5060	[email protected]
2920	[email protected]
728	[email protected]
1252	[email protected]
2920	[email protected]
5060	[email protected]
5060	[email protected]
1252	[email protected]
2920	[email protected]
728	[email protected]
728	[email protected]
1252	[email protected]
2920	[email protected]
5060	[email protected]
5060	[email protected]
1252	[email protected]
2920	[email protected]
728	[email protected]
728	[email protected]
5060	[email protected]
1252	[email protected]
2920	[email protected]
5060	[email protected]
1252	[email protected]
2920	[email protected]
728	[email protected]
2920	[email protected]
728	[email protected]
1252	[email protected]
5060	[email protected]
5060	[email protected]
1252	[email protected]
728	[email protected]
2920	[email protected]
2920	[email protected]
728	[email protected]
1252	[email protected]
5060	[email protected]
728	[email protected]
1252	[email protected]
2920	[email protected]
5060	[email protected]
728	[email protected]
5060	[email protected]
2920	[email protected]
1252	[email protected]
1252	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4244 wrote to memory of 2500	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 2500	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 1220	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 444	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 444	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe
PID 4244 wrote to memory of 3960	4244	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffd1daf9758,0x7ffd1daf9768,0x7ffd1daf9778
2⤵
PID:2500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:2
2⤵
PID:1220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:1
2⤵
PID:3684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:1
2⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4596 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:3716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:4108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1780,i,5713935230211695301,467980007141729393,131072 /prefetch:8
2⤵
PID:728

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:728

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1252

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5060

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1012

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:1120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8b68d428-a537-45fd-a185-91c03e8170da.tmp
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
926b8d81ed9f25d7dc00323eded66961

SHA1
80e2ab05186cf5b1e57a3d61b2ada54c1f6ea378

SHA256
8700648b78f7a485ea18b5c7c659821f3cd4bbf12dc4c4e075fa9a277948bdb6

SHA512
ab4d5bf86faa83041f7a7ee2d3ede27466ce526c7c16b35f04a8bdf527dc5bc59254314de8f343107f752556895e6e93f984909d5f6540a82f1e26bb442f7524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
cbc551e9160f1f015f245d3c0e327af0

SHA1
7bc6e3ad8d84159b0511e0809dcf8ef537950eaa

SHA256
9ffec5fb173ecc747cc2f2a302502574d59120baf031007688e5d753efea53a8

SHA512
cb2abcbdfedb7f60e497cc1cbfed5d43dd23d66ac5fc5154f96601d36fec327d8755f6a5216a7f65899b3c4b9260ba8189eaac75c737184b31f64524f7968002

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8fb2d7370dd00a6cc5651b696fb91e08

SHA1
658c1f9566abef64797b6f04ee220aa280f05577

SHA256
c8e479dfff223e389a836080878b118ad9a1d1a87d54fb1a35987173dc5fcc98

SHA512
0994fe43db8c8347e32f29a162d8083dfbebe78b27a70c11a6ec38b91645407a3d3087087144a00ca264c6d733ff381d200047cbd8bbac08f60c91afbfe9b971

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
abe85b0bc5608330c2b1075879f1d90a

SHA1
725e6928b9de1731781dc656de5df275701c7c84

SHA256
1b238f4a498dbfa1cf2e952eea91dc1fdb9934c57d7b20b4c8c9b22ae06bf795

SHA512
023c8ca94eef88e5550f462068c4144a5ca00a39db1bb9ea465b5a12fd8a5bed70c96d925430d1286004c20a625fc6b55a3eee0aaccb84258aedf3dc9e62b287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
45ce2802cb91be913e8c8332eb26dec7

SHA1
5866ca0b0eaae2a3d1de65b7aa281139cb6f108f

SHA256
54e87403195266a196d65a81fa853dd7ccababdef813084d029a8ccb567012fc

SHA512
41a629659d4618019f65f09d8e2b0f61e92418a9de445cc38b34e1b225262e6a492e82c195b45ed38f9ce64cb3cf32c894a1345e6a91b54c5c9e261849716f9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1cd484e60c9db1ca0761a381ac1585fe

SHA1
f29c03fdc0cfa7323eeb439577820b000abc0ab3

SHA256
3bbd82837e233be67270c3800088734c537b2db0617cf2d3586099161e0e7c1c

SHA512
2b81325103c970598e8aa7842a4839953bc4a0b6a2dff1ff55b1c71894e48284584ee13395267cfdd7aa8d6ad45050e4b5a8edd06c8aa531808a23b9090d474d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6c16de6f4f0b76943542f00f41b07937

SHA1
1fa35d4a0fd585a43b7626efc356adb50aef5e2f

SHA256
7333322e0c50c8135e7afbccd75879df972421b6c1f4225dc73a46db8647beea

SHA512
e950e99341fb9a6addbb73ba07aaff5323820a192c99252d191debb5d30e94fed6daf6b08c46cdfe3dbfdd3a26b949175408127a59e8c969fb773a2bccb210c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
15KB

MD5
a99a6f505f7f22da0b25eae684b99eb2

SHA1
9d9d7ed20d0b4399d27f36f27d3e61c8ba7e8bf6

SHA256
04ccb3f540a9e10b863dc9afa63f66e29fa19d931e585b7602a19beb0bdeaa19

SHA512
9140d1245f6f613c6b2978c33e1c97056bc50b198cb5cecbfa077d4a92268d4ee976bd0a985936fb8eeb1f041fa94cc144af5133a6cf16acd68124c1ef359f2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
173KB

MD5
17ddd5e3171cdacfd43f0140f5eec48f

SHA1
319e2797bfa71708d15e43d6d8986523c7f6e89e

SHA256
91ea054b9703c0fcfe8850eb2f1794731778976fe507298cddc30a65cac2bd95

SHA512
23870885d2cf2ff6e593e7e1c015ac9ef70bfae1cc073d274894d863eb3ee51c21b3c395b788ebf3641f51263d283dbed3f627a2fb7388885c851f007dd79946

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
102KB

MD5
6be360ceec67226bdb23a55c7ac0e045

SHA1
751bcd2fe97dfdaff389ea6c5087769182affdce

SHA256
e4bd095516100d0dbb9dd60c9c67a1c0558a92e223eba8147274e3cedd148e29

SHA512
eb7417fe48d47d5c233f57085666c7ebdc64b5f5b26e534f8d8c3d9e0640c89525e5c586e07f21a56e301d61bb673ab078d20804d31c9476bc904fc2073a9216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe56ea84.TMP
Filesize
96KB

MD5
f9e9b5e61122ce215ab963d5c60978b7

SHA1
02960088b4cbf3d7a6dca3ab3f8f29ed1731b89d

SHA256
d3383d25feed35f51f0a9ed51d5716657aebb2b06e2ea086cff8166b0b839b65

SHA512
5422ec33d2386513c02800a69f46bab70776829e8204ac12701165fb2a502b071e47d5a5f292c5bd533b7154126d336092d1fbdc24369298a42b24686adeae51

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\crashpad_4244_LSURVRFVEEWXMVSR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/636-310-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-312-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-311-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-316-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-317-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-319-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-318-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-320-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-321-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download
memory/636-322-0x0000028A2D290000-0x0000028A2D291000-memory.dmp

Filesize
4KB

Download