Overview

overview

6

Static

static

1

Bewerbung_...BH.pdf

windows10-1703-x64

6

Resubmissions

15/04/2023, 19:41

230415-yekhtafd651

03/04/2023, 15:03

230403-se1l5sfd966

03/04/2023, 15:01

230403-sd8w5afd921

03/04/2023, 14:59

230403-sc7mnshb4x4

03/04/2023, 14:58

230403-sb8tcafd796

03/04/2023, 14:55

230403-sagy8sfd696

03/04/2023, 14:53

230403-r9r3tafd586

Analysis

  • max time kernel
    159s
  • max time network
    168s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/04/2023, 14:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bewerbung_Preckel_Automobile_GmBH.pdf
  • Size 100KB
  • Sample230403-sagy8sfd69
  • SHA256 3148560eb1dc22d041879907be1c7181ddb75aaeee8974c25a369355ef97ebf1
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bewerbung_Preckel_Automobile_GmBH.pdf"
    1⤵
    • Checks processor information in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1652
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      2⤵
        PID:868
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        2⤵
          PID:1560
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          2⤵
            PID:4812
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2206C162205C1456A113D28D1CEA2A5F --mojo-platform-channel-handle=1600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:4220
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6AD73E755065F4F737D57F146AA1841F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6AD73E755065F4F737D57F146AA1841F --renderer-client-id=2 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job /prefetch:1
                3⤵
                  PID:4372
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=67E1F24A820E89EF06B55F97C67B798A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=67E1F24A820E89EF06B55F97C67B798A --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
                  3⤵
                    PID:524
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD42A621800119BBC20A61BF1548CA1E --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    3⤵
                      PID:3460
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F9B39283D55D56B5E5E8A6A67019F4B --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      3⤵
                        PID:2528
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=54F803E429D969035C6DD3B86FE1D331 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                        3⤵
                          PID:5080
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2448
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                        2⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2620
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.0.1536322250\678622983" -parentBuildID 20221007134813 -prefsHandle 1660 -prefMapHandle 1636 -prefsLen 20888 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a02c869-6448-466e-98b1-4df8db68090d} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 1740 178ad81ce58 gpu
                          3⤵
                            PID:2308
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.1.292650635\1477890220" -parentBuildID 20221007134813 -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 20969 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {484f725c-ec45-4280-8b50-b2986e815c25} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 2088 178ac512158 socket
                            3⤵
                              PID:2680
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.2.33293678\336282754" -childID 1 -isForBrowser -prefsHandle 2632 -prefMapHandle 2628 -prefsLen 21052 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9413773-655f-4db5-9d71-bd7e221d5c01} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 2668 178b06fb858 tab
                              3⤵
                                PID:4972
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.3.1165365917\2058621130" -childID 2 -isForBrowser -prefsHandle 3204 -prefMapHandle 3112 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a57b24cd-68a3-4e32-ba9f-76be0028d0ff} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 3264 178aedcc658 tab
                                3⤵
                                  PID:324
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.4.1120253208\2132996913" -childID 3 -isForBrowser -prefsHandle 3836 -prefMapHandle 3788 -prefsLen 26562 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ee1656d-1b45-45df-8f19-75d7a50a104b} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 3852 178b0ca4b58 tab
                                  3⤵
                                    PID:4772
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.5.1292264461\1209813346" -childID 4 -isForBrowser -prefsHandle 4340 -prefMapHandle 2828 -prefsLen 26621 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8e0b625-9950-4f39-a478-d7211ec44d60} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 4504 178b0d2f758 tab
                                    3⤵
                                      PID:4248
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.7.1916563632\1103030662" -childID 6 -isForBrowser -prefsHandle 4804 -prefMapHandle 4824 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d21fb83-66f0-4485-926b-34c26744e0a8} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 4840 178b2b50f58 tab
                                      3⤵
                                        PID:5076
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.6.398430036\485877309" -childID 5 -isForBrowser -prefsHandle 4756 -prefMapHandle 4792 -prefsLen 26702 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2071a69b-7585-46f8-9621-f6f737a25b23} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 4780 178b2bb7958 tab
                                        3⤵
                                          PID:5068
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.8.161695249\587935764" -childID 7 -isForBrowser -prefsHandle 3196 -prefMapHandle 4416 -prefsLen 26984 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4aab458-dbc9-48bf-a1b2-a977394e8a86} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 4676 178b3d95858 tab
                                          3⤵
                                            PID:1648
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2620.9.1632110102\368307212" -childID 8 -isForBrowser -prefsHandle 6036 -prefMapHandle 6032 -prefsLen 27374 -prefMapSize 232675 -jsInitHandle 1336 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6844a3c8-a7fc-41c9-8d11-6e32eef19e03} 2620 "\\.\pipe\gecko-crash-server-pipe.2620" 6044 178aedca858 tab
                                            3⤵
                                              PID:1776
                                        • C:\Windows\System32\SystemSettingsBroker.exe
                                          C:\Windows\System32\SystemSettingsBroker.exe -Embedding
                                          1⤵
                                            PID:3132
                                          • \??\c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
                                            1⤵
                                              PID:4892
                                            • \??\c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k localservice -s SstpSvc
                                              1⤵
                                                PID:4176
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                1⤵
                                                • Drops file in Windows directory
                                                • Checks SCSI registry key(s)
                                                • Modifies data under HKEY_USERS
                                                PID:404
                                              • \??\c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                1⤵
                                                • Drops file in Windows directory
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:872
                                              • \??\c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                                                1⤵
                                                  PID:3184
                                                • C:\Windows\system32\cmd.exe
                                                  "C:\Windows\system32\cmd.exe"
                                                  1⤵
                                                    PID:4060
                                                    • C:\Windows\system32\ipconfig.exe
                                                      ipconfig
                                                      2⤵
                                                      • Gathers network information
                                                      PID:4992
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:5092
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ffdc96e9758,0x7ffdc96e9768,0x7ffdc96e9778
                                                      2⤵
                                                        PID:656
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                        2⤵
                                                          PID:4780
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:2
                                                          2⤵
                                                            PID:4304
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                            2⤵
                                                              PID:5108
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                              2⤵
                                                                PID:3876
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                2⤵
                                                                  PID:224
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                  2⤵
                                                                    PID:4292
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:3864
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:3476
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                                        2⤵
                                                                          PID:4248
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:8
                                                                          2⤵
                                                                            PID:3432
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4984 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                            2⤵
                                                                              PID:4468
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3164 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:5760
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3100 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                2⤵
                                                                                  PID:5896
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4708 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5928
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5904 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5144
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5884 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4700
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5008 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4188
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5480 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1640
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4188 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                            2⤵
                                                                                              PID:6136
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5488 --field-trial-handle=1740,i,12104121527411328852,17015918233127405983,131072 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6124
                                                                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:4248

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    ReaderMessages
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                    • Size 36KB
                                                                                                    • SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                                                    • Size 471B
                                                                                                    • SHA256 29e6de16bc16d88218ee1617fdb4eca2e9924e905408992c4f7d48233051b44c
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                                                    • Size 430B
                                                                                                    • SHA256 60bcf3a97f71ab8046d432dabad4cbdece8df5de6e176baa7b38a2823ab07482
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    TransportSecurity
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                    • Size 1KB
                                                                                                    • SHA256 c08822344dbdc614595b23338d86787e053e5a06751f054f61f4e51e15d8074a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                    • Size 5KB
                                                                                                    • SHA256 f0e9ff74d87f6514ed7f94cd714e822d833dd376407451d6238aeea32e8c0185
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                    • Size 174KB
                                                                                                    • SHA256 7bada989c06bdb276df3fe535e3cb58200ca6f680232bc951af206e8a3f9979b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    persisted_first_party_sets.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    activity-stream.discovery_stream.json.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\510gyhsb.default-release\activity-stream.discovery_stream.json.tmp
                                                                                                    • Size 161KB
                                                                                                    • SHA256 ca25a437a64f61880688c0a0f648d891fcaa53099da64edcdddc1b14944f5bf4
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    prefs.js
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\prefs.js
                                                                                                    • Size 6KB
                                                                                                    • SHA256 81db871d08aa9e5a991e6e04e462d416753cb92830860bca520d0c73d69b07c0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    recovery.jsonlz4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                    • Size 1KB
                                                                                                    • SHA256 a919f73369f4067dc33fcad63eae8fa047f4ff262f78ce297f7fa4d7a1167045
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    recovery.jsonlz4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                    • Size 1KB
                                                                                                    • SHA256 5243180c5dc2ae2528b6af91480e5ea4b9ecb1f47f8c24a4074a1d9a0ae552d9
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    sessionstore.jsonlz4
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\sessionstore.jsonlz4
                                                                                                    • Size 1KB
                                                                                                    • SHA256 68107b729377973eb20e238f81306546e2c48038450583de18ba80b4bfd8bea8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    3870112724rsegmnoittet-es.sqlite
                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\510gyhsb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                    • Size 184KB
                                                                                                    • SHA256 62a0f79699012ba341a3623e3c5cfa6a826173d2a3f95ac961e30468945cc8ce
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    netrasa.PNF
                                                                                                    • Path C:\Windows\INF\netrasa.PNF
                                                                                                    • Size 22KB
                                                                                                    • SHA256 e73e034e34d9c6f40f67efc2e0ccee7b47ba7234ac78f803cdc9bd78c68efc8a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    netsstpa.PNF
                                                                                                    • Path C:\Windows\INF\netsstpa.PNF
                                                                                                    • Size 6KB
                                                                                                    • SHA256 35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                    Submit Download

                                                                                                    memory/1560-219-0x0000000001820000-0x00000000018CE000-memory.dmp
                                                                                                    Download