be9885913c63b467e102d7650841bd56dc038e4d347c7823fe78c8205917cc2d

Resubmissions

06/05/2023, 03:34

230506-d4318sab4x 8

06/05/2023, 03:31

230506-d24jzsfh36 10

06/05/2023, 03:27

230506-dz82paab2z 10

06/05/2023, 03:16

230506-dsqlrsaa71 10

Analysis

max time kernel
140s
max time network
160s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/05/2023, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Size

1.3MB
MD5

c6326212f846c43fd017ae3ecd6e7f4d
SHA1

c92d9d6a4df83cd701ab170209a3af9d381ca928
SHA256

00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896
SHA512

fd0d59818687ecebec17820d63bcb61c0e0a4a5253899439e311e0f431234abf22f22cfc88de7801e5c5d95392b9da1e331bf43cfc15a406381fb4b02cbb6268
SSDEEP

24576:1yV1s8yRxwV7JGccW9Uan8Ax+dAuQ52W0oIw0A8IZ:Q3s8yRUJGccYUa/yV8x0oIwE

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	n8400605.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	n8400605.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	n8400605.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	n8400605.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	n8400605.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	n8400605.exe

Executes dropped EXE 5 IoCs

pid	Process
1072	z2782167.exe
1948	z0741032.exe
240	z9472836.exe
1704	n8400605.exe
580	o8123542.exe

Loads dropped DLL 11 IoCs

pid	Process
324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
1072	z2782167.exe
1072	z2782167.exe
1948	z0741032.exe
1948	z0741032.exe
240	z9472836.exe
240	z9472836.exe
240	z9472836.exe
1704	n8400605.exe
240	z9472836.exe
580	o8123542.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	n8400605.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	n8400605.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z0741032.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z0741032.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z9472836.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9472836.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	z2782167.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2782167.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1704	n8400605.exe
1704	n8400605.exe
776	chrome.exe
776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	n8400605.exe
Token: 33	1272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1272	AUDIODG.EXE
Token: 33	1272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1272	AUDIODG.EXE
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe
Token: SeShutdownPrivilege	776	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe
776	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 324 wrote to memory of 1072	324	00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe	27
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1072 wrote to memory of 1948	1072	z2782167.exe	28
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 1948 wrote to memory of 240	1948	z0741032.exe	29
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 1704	240	z9472836.exe	30
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 240 wrote to memory of 580	240	z9472836.exe	34
PID 776 wrote to memory of 1572	776	chrome.exe	38
PID 776 wrote to memory of 1572	776	chrome.exe	38
PID 776 wrote to memory of 1572	776	chrome.exe	38
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40
PID 776 wrote to memory of 716	776	chrome.exe	40

C:\Users\Admin\AppData\Local\Temp\00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe
"C:\Users\Admin\AppData\Local\Temp\00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:324
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:240
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Loads dropped DLL
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:580

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6309758,0x7fef6309768,0x7fef6309778
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:2
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2140 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2536 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=928 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 --field-trial-handle=1220,i,9522307380085504698,1478363514820089111,131072 /prefetch:8
  2⤵
  PID:2908

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0dac441a-55a3-4515-8c4b-9ee277eca042.tmp

Filesize
4KB

MD5
9bb8bfd92eb58640d76106b04aba443c

SHA1
b247bddb354b37bb34d55bcce0afb909d86b68d7

SHA256
cbe4b73cbc14add7e1111630654f1e7d8af1bef61e69ecdb4eb74655c1f13f27

SHA512
31d2d38cc094b98363e95f61af9ef435db4a39798a8e194a7f203b1d4a623e8c8e9e5598b292f3fd11e5a1776e22267087fbcac75f5273a9a471623cde6e477d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6e6e5d.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
1c385f019468e2998ff66286b64f15a7

SHA1
da805500311a70fbcac02d580a6b59a2cfcc79f7

SHA256
1d61cd13e756ad9a418bac773a4b80e8abf3ea7d8b63f61db1f5c6ebc454006b

SHA512
8c3d0bb87c9e3e42de97a3d0de1e837ccb4fa694ecd2736389039a80ee886c0df1cc3c42d8cb274c1e7b775f306a85c794cb407dd2c9171a9ef07fbe608e7908

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe

Filesize
1.1MB

MD5
6de3329e4817473b6b8ac62a3c5c6b59

SHA1
382b23d4ca29863993d5f932820053c66737b020

SHA256
40f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5

SHA512
9efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe

Filesize
1.1MB

MD5
6de3329e4817473b6b8ac62a3c5c6b59

SHA1
382b23d4ca29863993d5f932820053c66737b020

SHA256
40f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5

SHA512
9efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe

Filesize
621KB

MD5
3730c6ca253a6bec0c560547d29950c9

SHA1
5bbab824cb4d766eb38d5e847d5ff38cd1a06ab3

SHA256
2ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd

SHA512
d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe

Filesize
621KB

MD5
3730c6ca253a6bec0c560547d29950c9

SHA1
5bbab824cb4d766eb38d5e847d5ff38cd1a06ab3

SHA256
2ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd

SHA512
d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe

Filesize
417KB

MD5
fee3ee82da864a63149dcad7ae84dd08

SHA1
9b5d6a19607bc51e2d30280412214995afbbfccf

SHA256
6dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996

SHA512
fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe

Filesize
417KB

MD5
fee3ee82da864a63149dcad7ae84dd08

SHA1
9b5d6a19607bc51e2d30280412214995afbbfccf

SHA256
6dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996

SHA512
fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe

Filesize
136KB

MD5
cc60cb4f3504297fed428ecbf5f17f66

SHA1
2bc25e3901a136be933cd3e2ba32c0b4cdc99982

SHA256
9759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef

SHA512
89ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe

Filesize
1.1MB

MD5
6de3329e4817473b6b8ac62a3c5c6b59

SHA1
382b23d4ca29863993d5f932820053c66737b020

SHA256
40f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5

SHA512
9efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2782167.exe

Filesize
1.1MB

MD5
6de3329e4817473b6b8ac62a3c5c6b59

SHA1
382b23d4ca29863993d5f932820053c66737b020

SHA256
40f8b276607d020b68b7b72a119cdd1fbb3d69e059156954a7f739b8fcfa0ed5

SHA512
9efd59bcf78e22e00f4fbd69b87a3f4b946de2281713f0893f11c233b1515d3a3e23ecb13a1ffed5a773451d602bdb87652c2d75b5ca0d3f658cd84c03faa021

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe

Filesize
621KB

MD5
3730c6ca253a6bec0c560547d29950c9

SHA1
5bbab824cb4d766eb38d5e847d5ff38cd1a06ab3

SHA256
2ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd

SHA512
d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0741032.exe

Filesize
621KB

MD5
3730c6ca253a6bec0c560547d29950c9

SHA1
5bbab824cb4d766eb38d5e847d5ff38cd1a06ab3

SHA256
2ede7db066aea98b9ab440bcf3459df99a732f2a7f4006e1109a18a98acafefd

SHA512
d04ba71401db9e415206ccdbd92ca3211f10c052ecda7e76948ebacf0c06d0f2336fe2cf7c767e780b5903516168a7390671b60624ab5fc984ae302bddcd4203

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe

Filesize
417KB

MD5
fee3ee82da864a63149dcad7ae84dd08

SHA1
9b5d6a19607bc51e2d30280412214995afbbfccf

SHA256
6dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996

SHA512
fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9472836.exe

Filesize
417KB

MD5
fee3ee82da864a63149dcad7ae84dd08

SHA1
9b5d6a19607bc51e2d30280412214995afbbfccf

SHA256
6dd292c345cc87952f5c7e8022b1fdc63314b7ae8763a0a2f785ea7d811c5996

SHA512
fda497744fe1e9cb343822fed06548f9c052e071bbfae19f9eb34f47c97513edb080cf49712d313b7d9033fa25de8d74fe8d61519de94e243c23c1f5ec70a26d

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\n8400605.exe

Filesize
360KB

MD5
7ee65377a741d142faa2f927f6aa78bb

SHA1
c07e33ef45490ba4937e308c513558c717ae76ca

SHA256
cc4eb5b47d66e17b9ea66334f826e6121d501e994380b0ce150b8ec27eb9bb29

SHA512
870a30536148ebf0614d5a870a00b5bb1e137cad428c66f1908f65f65104964dfc70e9b8425785b8de0fb6da5312a4002001bf0df147c6f7bf6c9122004d3c9f

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe

Filesize
136KB

MD5
cc60cb4f3504297fed428ecbf5f17f66

SHA1
2bc25e3901a136be933cd3e2ba32c0b4cdc99982

SHA256
9759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef

SHA512
89ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de

Download Submit
\Users\Admin\AppData\Local\Temp\IXP003.TMP\o8123542.exe

Filesize
136KB

MD5
cc60cb4f3504297fed428ecbf5f17f66

SHA1
2bc25e3901a136be933cd3e2ba32c0b4cdc99982

SHA256
9759986068c7f098c6a5e1b48ca54696f3c2a819fd8837cc3e41337ea1355bef

SHA512
89ede7e141763644ff05d4f0949ec2e28b8161fd0ddeadbea2f9daeb83d72edf5a604c56703118b4869d07f1c40626b5da23488c2f48fddbcc1df19dddae86de

Download Submit
memory/580-140-0x0000000072E60000-0x000000007354E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-106-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-114-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-118-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-120-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-122-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-124-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-126-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-128-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-129-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/1704-130-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1704-131-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/1704-132-0x0000000000280000-0x00000000002AD000-memory.dmp

Filesize
180KB

Download
memory/1704-116-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-110-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-112-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-108-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-104-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-102-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-101-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/1704-100-0x0000000002170000-0x0000000002188000-memory.dmp

Filesize
96KB

Download
memory/1704-99-0x0000000002150000-0x000000000216A000-memory.dmp

Filesize
104KB

Download
memory/1704-98-0x0000000000280000-0x00000000002AD000-memory.dmp

Filesize
180KB

Download