grandoreiro | 3e033ac5385c7a77ef87090674c19061d8fce08a48d451d78a03d32eda516243

Resubmissions

05/05/2023, 18:01

230505-wlymxadg5v 10

05/04/2023, 12:09

230405-pbfwsage6z 7

Analysis

max time kernel
709s
max time network
644s
platform
windows10-2004_x64
resource
win10v2004-20230221-es
resource tags

arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05/05/2023, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Archivo.EndesaFactur-A4-SIMPLEX-TLLK_B23032023E294942222422244454.MSI.msi
Size

3.0MB
MD5

f8e3482185e2c916fc032786e676d320
SHA1

f605b599179349ec50919c521191daf718a587c8
SHA256

3e033ac5385c7a77ef87090674c19061d8fce08a48d451d78a03d32eda516243
SHA512

1024136d4fbcfe68de382d22fb160b16ed9a95e54ccf240a0a09c27bf49bd0ec3e7f0ad15e35701698a0d49cf0bda7649a66cf81db19ec272fe501517db8987e
SSDEEP

49152:LoYafBZfn6JDi5FQ5dtSdgIH/5roi5VzQ78r6F5mCmR+CYuNA:YfPf/BoEzMo6cYIA

Score

10^/10

grandoreiro banker trojan

Malware Config

Signatures

Detects Grandoreiro payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000200000001e2ac-224.dat	family_grandoreiro_v1
behavioral2/files/0x000200000001e2ac-221.dat	family_grandoreiro_v1
behavioral2/files/0x000200000001e2ac-226.dat	family_grandoreiro_v1
behavioral2/memory/1352-228-0x00000000014A0000-0x00000000036A2000-memory.dmp	family_grandoreiro_v1
behavioral2/memory/1352-246-0x00000000014A0000-0x00000000036A2000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro

Blocklisted process makes network request 6 IoCs

flow	pid	Process
48	4404	MsiExec.exe
52	4404	MsiExec.exe
62	4404	MsiExec.exe
69	4404	MsiExec.exe
71	4404	MsiExec.exe
72	4404	MsiExec.exe

Executes dropped EXE 1 IoCs

pid	Process
1352	HostFx.exe

Loads dropped DLL 6 IoCs

pid	Process
4404	MsiExec.exe
4404	MsiExec.exe
4404	MsiExec.exe
1352	HostFx.exe
1352	HostFx.exe
1352	HostFx.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9E94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F6F4774B-4CA1-41A3-84D8-A46269C2E457}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI151D.tmp	msiexec.exe
File created	C:\Windows\Installer\e59ae86.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ae86.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC8B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20F5.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1544	msiexec.exe
1544	msiexec.exe
1352	HostFx.exe
1352	HostFx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1444	msiexec.exe
Token: SeSecurityPrivilege	1544	msiexec.exe
Token: SeCreateTokenPrivilege	1444	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1444	msiexec.exe
Token: SeLockMemoryPrivilege	1444	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1444	msiexec.exe
Token: SeMachineAccountPrivilege	1444	msiexec.exe
Token: SeTcbPrivilege	1444	msiexec.exe
Token: SeSecurityPrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeLoadDriverPrivilege	1444	msiexec.exe
Token: SeSystemProfilePrivilege	1444	msiexec.exe
Token: SeSystemtimePrivilege	1444	msiexec.exe
Token: SeProfSingleProcessPrivilege	1444	msiexec.exe
Token: SeIncBasePriorityPrivilege	1444	msiexec.exe
Token: SeCreatePagefilePrivilege	1444	msiexec.exe
Token: SeCreatePermanentPrivilege	1444	msiexec.exe
Token: SeBackupPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeShutdownPrivilege	1444	msiexec.exe
Token: SeDebugPrivilege	1444	msiexec.exe
Token: SeAuditPrivilege	1444	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1444	msiexec.exe
Token: SeChangeNotifyPrivilege	1444	msiexec.exe
Token: SeRemoteShutdownPrivilege	1444	msiexec.exe
Token: SeUndockPrivilege	1444	msiexec.exe
Token: SeSyncAgentPrivilege	1444	msiexec.exe
Token: SeEnableDelegationPrivilege	1444	msiexec.exe
Token: SeManageVolumePrivilege	1444	msiexec.exe
Token: SeImpersonatePrivilege	1444	msiexec.exe
Token: SeCreateGlobalPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeRestorePrivilege	1544	msiexec.exe
Token: SeTakeOwnershipPrivilege	1544	msiexec.exe
Token: SeShutdownPrivilege	1788	chrome.exe
Token: SeCreatePagefilePrivilege	1788	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe
Token: SeShutdownPrivilege	2752	chrome.exe
Token: SeCreatePagefilePrivilege	2752	chrome.exe
Token: SeShutdownPrivilege	3188	chrome.exe
Token: SeCreatePagefilePrivilege	3188	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1444	msiexec.exe
1444	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4404	1544	msiexec.exe	83
PID 1544 wrote to memory of 4404	1544	msiexec.exe	83
PID 1544 wrote to memory of 4404	1544	msiexec.exe	83
PID 4404 wrote to memory of 1352	4404	MsiExec.exe	98
PID 4404 wrote to memory of 1352	4404	MsiExec.exe	98
PID 4404 wrote to memory of 1352	4404	MsiExec.exe	98
PID 1788 wrote to memory of 4568	1788	chrome.exe	100
PID 1788 wrote to memory of 4568	1788	chrome.exe	100
PID 3188 wrote to memory of 1072	3188	chrome.exe	104
PID 3188 wrote to memory of 1072	3188	chrome.exe	104
PID 2752 wrote to memory of 3496	2752	chrome.exe	106
PID 2752 wrote to memory of 3496	2752	chrome.exe	106
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 3188 wrote to memory of 2208	3188	chrome.exe	108
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109
PID 2752 wrote to memory of 2416	2752	chrome.exe	109

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Archivo.EndesaFactur-A4-SIMPLEX-TLLK_B23032023E294942222422244454.MSI.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C8C905ADEA3C2DE5E53CEAE10C9A33AB
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Spainguide\HostFx.exe
    "C:\Spainguide\HostFx.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffff16d9758,0x7ffff16d9768,0x7ffff16d9778
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1840,i,13304500837112833523,5921342494895996391,131072 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1840,i,13304500837112833523,5921342494895996391,131072 /prefetch:8
  2⤵
  PID:924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Modifies registry class
PID:4956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff16d9758,0x7ffff16d9768,0x7ffff16d9778
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1860,i,1916871067672131456,6116658212891071274,131072 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1860,i,1916871067672131456,6116658212891071274,131072 /prefetch:8
  2⤵
  PID:952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffff16d9758,0x7ffff16d9768,0x7ffff16d9778
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1904,i,6491475709538036479,7620396588446819981,131072 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1904,i,6491475709538036479,7620396588446819981,131072 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1904,i,6491475709538036479,7620396588446819981,131072 /prefetch:8
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59ae88.rbs

Filesize
815B

MD5
34fd28f388ed470c84713f7324f0107b

SHA1
cf4b38e3281ad5b2f0611db93c740ccc36341a05

SHA256
8669853279b192154b1363a1cfae6018d199169f0fe1c888253a2f7d34f60986

SHA512
7c11c91e7ef39ae566edef36abd5df6a0ba96d818977e59b609a2a8af6db5fa07c97fbd799a8ff178443ac722a692986a6933cc4e74197ec22ab211aa521cba9

Download Submit
C:\Spainguide\HostFx.exe

Filesize
2.2MB

MD5
b5485d229f8078575d639fb903b4fca7

SHA1
6a67a6bb694df592819d398a645504b2c7a2221c

SHA256
9625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782

SHA512
5d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8

Download Submit
C:\Spainguide\HostFx.exe

Filesize
2.2MB

MD5
b5485d229f8078575d639fb903b4fca7

SHA1
6a67a6bb694df592819d398a645504b2c7a2221c

SHA256
9625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782

SHA512
5d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8

Download Submit
C:\Spainguide\HostFx.exe

Filesize
2.2MB

MD5
b5485d229f8078575d639fb903b4fca7

SHA1
6a67a6bb694df592819d398a645504b2c7a2221c

SHA256
9625e775e955281732270b7a0fc468bef83b468be85e82e0659973aefa369782

SHA512
5d54f343b986d33c3e7de1450d8b6386bac66a9aeb8a77b0a81652cf2592e8f85847185d6e09e8c486a224bf21eb195308be1f489bbac615bf99d5fc760d85f8

Download Submit
C:\Spainguide\dbghelp.dll

Filesize
1.2MB

MD5
4003e34416ebd25e4c115d49dc15e1a7

SHA1
faf95ec65cde5bd833ce610bb8523363310ec4ad

SHA256
c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

SHA512
88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

Download Submit
C:\Spainguide\dbghelp.dll

Filesize
1.2MB

MD5
4003e34416ebd25e4c115d49dc15e1a7

SHA1
faf95ec65cde5bd833ce610bb8523363310ec4ad

SHA256
c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

SHA512
88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

Download Submit
C:\Spainguide\uires.dll

Filesize
13.0MB

MD5
87c7411e05ff159a3707869adc9d5c01

SHA1
d147cfdc5d2ea979aa757423a0a22577c45acbe1

SHA256
207d66dae08ca39065019355802604768b213ed2817e78bea128f136784af6a7

SHA512
a5a22ed12fa2ea7d343fa38e527fab8735924e350dd138b72e2bec4417825b8bab52e6814ced320f67030fa3a0b88afd7a50ac1714476f40d9ec54c33acae922

Download Submit
C:\Spainguide\zlibai.dll

Filesize
33.9MB

MD5
60e42461cb89d736403e7a2241b53f5a

SHA1
e0a6ebb90d891c7b9e565cec91a0ce7ccf8d85fe

SHA256
99f5e8c8fbcf05e62af0ba78f3d791359930da1d343c04149b2a9b53ed0bb35b

SHA512
5cda1a3f189915703a4fa2634201c729d98b9f98d5b2b4ae52e5a0fe1cff4522a2a736e9a443bc12805cbd343c1d455fbced02fa2ca52ade0a44267ceac5cfa1

Download Submit
C:\Spainguide\zlibai.dll

Filesize
33.9MB

MD5
60e42461cb89d736403e7a2241b53f5a

SHA1
e0a6ebb90d891c7b9e565cec91a0ce7ccf8d85fe

SHA256
99f5e8c8fbcf05e62af0ba78f3d791359930da1d343c04149b2a9b53ed0bb35b

SHA512
5cda1a3f189915703a4fa2634201c729d98b9f98d5b2b4ae52e5a0fe1cff4522a2a736e9a443bc12805cbd343c1d455fbced02fa2ca52ade0a44267ceac5cfa1

Download Submit
C:\Spainguide\zlibai.dll

Filesize
33.9MB

MD5
60e42461cb89d736403e7a2241b53f5a

SHA1
e0a6ebb90d891c7b9e565cec91a0ce7ccf8d85fe

SHA256
99f5e8c8fbcf05e62af0ba78f3d791359930da1d343c04149b2a9b53ed0bb35b

SHA512
5cda1a3f189915703a4fa2634201c729d98b9f98d5b2b4ae52e5a0fe1cff4522a2a736e9a443bc12805cbd343c1d455fbced02fa2ca52ade0a44267ceac5cfa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
725dfadacd7b746ba806f956314d8daf

SHA1
a217932961c1c5e788d3e2ec98f0451431d564a3

SHA256
5b496c58006f91bd0a1b1c08789fcf0415cf2ff1c0ed2044e9dd0f0a7d29679c

SHA512
ab63cfcd15058ddef4623d6da2e286658a5d225e31261a55829b1a4d77b92d91dc18d02cd71a5c0bab2d2a395a1d7aa91194764c3eb3fe6b2632e25002c9c8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
725dfadacd7b746ba806f956314d8daf

SHA1
a217932961c1c5e788d3e2ec98f0451431d564a3

SHA256
5b496c58006f91bd0a1b1c08789fcf0415cf2ff1c0ed2044e9dd0f0a7d29679c

SHA512
ab63cfcd15058ddef4623d6da2e286658a5d225e31261a55829b1a4d77b92d91dc18d02cd71a5c0bab2d2a395a1d7aa91194764c3eb3fe6b2632e25002c9c8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
725dfadacd7b746ba806f956314d8daf

SHA1
a217932961c1c5e788d3e2ec98f0451431d564a3

SHA256
5b496c58006f91bd0a1b1c08789fcf0415cf2ff1c0ed2044e9dd0f0a7d29679c

SHA512
ab63cfcd15058ddef4623d6da2e286658a5d225e31261a55829b1a4d77b92d91dc18d02cd71a5c0bab2d2a395a1d7aa91194764c3eb3fe6b2632e25002c9c8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
725dfadacd7b746ba806f956314d8daf

SHA1
a217932961c1c5e788d3e2ec98f0451431d564a3

SHA256
5b496c58006f91bd0a1b1c08789fcf0415cf2ff1c0ed2044e9dd0f0a7d29679c

SHA512
ab63cfcd15058ddef4623d6da2e286658a5d225e31261a55829b1a4d77b92d91dc18d02cd71a5c0bab2d2a395a1d7aa91194764c3eb3fe6b2632e25002c9c8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
725dfadacd7b746ba806f956314d8daf

SHA1
a217932961c1c5e788d3e2ec98f0451431d564a3

SHA256
5b496c58006f91bd0a1b1c08789fcf0415cf2ff1c0ed2044e9dd0f0a7d29679c

SHA512
ab63cfcd15058ddef4623d6da2e286658a5d225e31261a55829b1a4d77b92d91dc18d02cd71a5c0bab2d2a395a1d7aa91194764c3eb3fe6b2632e25002c9c8c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
16b7586b9eba5296ea04b791fc3d675e

SHA1
8890767dd7eb4d1beab829324ba8b9599051f0b0

SHA256
474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680

SHA512
58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
85B

MD5
bc6142469cd7dadf107be9ad87ea4753

SHA1
72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

SHA256
b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

SHA512
47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

Download Submit
C:\Windows\Installer\MSI20F5.tmp

Filesize
2.3MB

MD5
997dd8e1f951664764d16d33fac161d2

SHA1
a7d5542193af4d8caec561940174b1bff3e1167f

SHA256
70f987fab68e6d87aa1aa6e98fc76acb20f8e8fd8621e56c5764f48c3aa517bd

SHA512
d08e644e741f985e5b2ec65f6fe0eead3707a7cb7a26c4ad8063d559e4a32bce79d1daef12c556a874f9cac043dac995d1e65ae775879a63dd608f6ea5b85dde

Download Submit
C:\Windows\Installer\MSI20F5.tmp

Filesize
2.3MB

MD5
997dd8e1f951664764d16d33fac161d2

SHA1
a7d5542193af4d8caec561940174b1bff3e1167f

SHA256
70f987fab68e6d87aa1aa6e98fc76acb20f8e8fd8621e56c5764f48c3aa517bd

SHA512
d08e644e741f985e5b2ec65f6fe0eead3707a7cb7a26c4ad8063d559e4a32bce79d1daef12c556a874f9cac043dac995d1e65ae775879a63dd608f6ea5b85dde

Download Submit
C:\Windows\Installer\MSI9E94.tmp

Filesize
557KB

MD5
2c9c51ac508570303c6d46c0571ea3a1

SHA1
e3e0fe08fa11a43c8bca533f212bdf0704c726d5

SHA256
ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

SHA512
df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

Download Submit
C:\Windows\Installer\MSI9E94.tmp

Filesize
557KB

MD5
2c9c51ac508570303c6d46c0571ea3a1

SHA1
e3e0fe08fa11a43c8bca533f212bdf0704c726d5

SHA256
ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

SHA512
df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

Download Submit
C:\Windows\Installer\MSIDC8B.tmp

Filesize
557KB

MD5
2c9c51ac508570303c6d46c0571ea3a1

SHA1
e3e0fe08fa11a43c8bca533f212bdf0704c726d5

SHA256
ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

SHA512
df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

Download Submit
C:\Windows\Installer\MSIDC8B.tmp

Filesize
557KB

MD5
2c9c51ac508570303c6d46c0571ea3a1

SHA1
e3e0fe08fa11a43c8bca533f212bdf0704c726d5

SHA256
ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

SHA512
df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

Download Submit
memory/1352-239-0x00000000036B0000-0x00000000036B1000-memory.dmp

Filesize
4KB

Download
memory/1352-228-0x00000000014A0000-0x00000000036A2000-memory.dmp

Filesize
34.0MB

Download
memory/1352-244-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1352-245-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/1352-246-0x00000000014A0000-0x00000000036A2000-memory.dmp

Filesize
34.0MB

Download
memory/1352-268-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/1352-267-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/1352-266-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1352-242-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/1352-241-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1352-240-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/1352-243-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/4404-195-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-157-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-153-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-154-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-180-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-227-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-155-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-191-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download
memory/4404-192-0x0000000074120000-0x0000000074374000-memory.dmp

Filesize
2.3MB

Download