hxxps://www[.]bamsoftware[.]com/hacks/zipbomb/zblg[.]zip

Analysis

max time kernel
300s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2023, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.bamsoftware.com/hacks/zipbomb/zblg.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133311569827429449"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
3760	chrome.exe
3760	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1528	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe
Token: SeShutdownPrivilege	1668	chrome.exe
Token: SeCreatePagefilePrivilege	1668	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
828	7zG.exe
828	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe
1668	chrome.exe

Suspicious use of SetWindowsHookEx 59 IoCs

pid	Process
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
3188	OpenWith.exe
1000	WORDPAD.EXE
1000	WORDPAD.EXE
1000	WORDPAD.EXE
1000	WORDPAD.EXE
1000	WORDPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2072	1668	chrome.exe	83
PID 1668 wrote to memory of 2072	1668	chrome.exe	83
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4556	1668	chrome.exe	84
PID 1668 wrote to memory of 4976	1668	chrome.exe	85
PID 1668 wrote to memory of 4976	1668	chrome.exe	85
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86
PID 1668 wrote to memory of 4512	1668	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.bamsoftware.com/hacks/zipbomb/zblg.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4f829758,0x7ffc4f829768,0x7ffc4f829778
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5404 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5564 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5560 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5360 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5716 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,8648138896229606798,6405412460383703147,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4020

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\zblg\" -ad -an -ai#7zMap3365:70:7zEvent6314
1⤵
- Suspicious use of FindShellTrayWindow
PID:828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1528
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\zblg\4
  2⤵
  PID:3840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3188
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Downloads\zblg\4"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0190ea8e-35ed-40c9-ac9f-2534c69dc090.tmp

Filesize
6KB

MD5
c185ab594f870b96427f08cd8d82b529

SHA1
31ccd4303491606536d76aac2e63604e6f2151a4

SHA256
3c86a503a96d3d98c707ade93e3f3709388b42cafa8d5eb6023cbd957a36b584

SHA512
e240c8e1558e302706a6fa001b4abfd4d45bf70579c39b422f6819cd2e84417f08e623655706a7f10c920c316d5f9f80c7c3cd450a42c4ad693efb28ca526b4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1000B

MD5
e30bae709eaf19a8d4d91ceced99de1f

SHA1
4d293d531e3bfb8b41c92253d826d2d9d2f31e4f

SHA256
e8598ab708bf4ad91bea5c31060718c83be79e7d2f9b8707b1b181f5df3b6f41

SHA512
546a094f8152453ce374bcfc8beb58f83a1f24962ef10ff2e34ce3d25016be7fea1bd74f4593090e4cd7addb1a28607b8cf6ae2f198ee3ab651b49ee8ba01f2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
53f38feff4952ef39805452792222672

SHA1
52d71fe34b5fd1c03aaf2eac6ca8ea57025c2fad

SHA256
5270b9dcbe05b3ac9a36d5ef7ead1897f6388ad40360ad62642519489fb66d4f

SHA512
6572a3476584b4e6d9084c55c4cf6f3476e5029ab94229f420a3775261322bd40d35880bc7c1eada24c68ad5062ed51d62b8e2e03b302a4793bb15279d06c295

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c167677ec7d6490a1c19a3b32d35bb90

SHA1
1b1ee923bed449b567be9394e8f906575601e669

SHA256
65c53496359cc1f2a4c0532edc8512e8abc998748cb329705dc951ac34605266

SHA512
76baeea4d2c83ea56f3e0f0e7166e6ac1a3f1e87426aad202d677fef88b60327a3ee839ff6fd425406fb2b8add916aee6ad65e2941ec5704e4acb4f3facf1ed2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
cf803377c543bfedb4b8d0ad60b52c5c

SHA1
be081759abfc7fb6b99e84a769067cbc4f4671fe

SHA256
76b08b2f8fa9ab90ead9e36332a28dc88a60f3f8c7ce0586ad310c5286e52bd7

SHA512
cf715975a43bc4c40c09e210ecd1ebaf4f54b5c6b3f7e19aed3e4709b7e5bcf822dc9b72dd7838ae35e0058826349afcd49046d66ef3777d3910731044ba7d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
72KB

MD5
94f523c2436cd1b5b07f3316ac56e018

SHA1
8d2ad6fac7e86c7850cbdb2876437bcfc4f5ec1d

SHA256
c629411d15bc476ff2f117337beada8c5f461e6e96fe32826381a46edbefb1e1

SHA512
15c01efd7d06725a968692fe8e63ef4f877543421c760280d5e54aee400df10b3cd97ef4c020c1dfd2cb9f3fec530f0879ece82c8953615efcad48b41435d4cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
161KB

MD5
69e8b4296331c07bdfabd5f584c74ee3

SHA1
24244c825f92ad11246eb1cec47777ff90c2cd93

SHA256
2244ed62576d0bd559a96867af1424c773c1b83edebee786a68a5c977e538e12

SHA512
dd90a52327f85634a76a8fc94c70066817bc308147c64ad0ff74543df5c0918384c68f3c6afe99ce311f3352f810f12fc8eefa94ed732fb263f80c2701566dcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
160KB

MD5
e768bf3d8779bcda86cd79b19157e636

SHA1
3c1e410ef88558009cd599008e3a962f17befcba

SHA256
7015b6662f8e9ed8ea76ef6c5dae0f583e00dc8f6810b4f91751bde56861a8ed

SHA512
bfc358f79b7ec45ddda187277ff1919fc2b443eeb077d813dd1e4c27edcfe2837508c82605b806660327ef7e497f71e903714b6347aa204fb7af25aa5eff7d90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1668_998461250\767f5e2c-32df-4b1e-97d1-7467d020493d.tmp

Filesize
88KB

MD5
2cc86b681f2cd1d9f095584fd3153a61

SHA1
2a0ac7262fb88908a453bc125c5c3fc72b8d490e

SHA256
d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

SHA512
14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1668_998461250\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\Downloads\zblg.zip

Filesize
9.4MB

MD5
207b597f03033b2e0644bbbc29f04053

SHA1
0ad88c964f6f7eebafa7156080a7bcd90ab32a16

SHA256
f1dc920869794df3e258f42f9b99157104cd3f8c14394c1b9d043d6fcda14c0a

SHA512
f50cdf77557160a7294406e1f2d57ca789ec42834881069281e88ac334fbaad901229da0e460b26a1b69724a4adbf9d0e92adba9c3ac86aa1603b857789c1db6

Download Submit
C:\Users\Admin\Downloads\zblg.zip

Filesize
9.4MB

MD5
207b597f03033b2e0644bbbc29f04053

SHA1
0ad88c964f6f7eebafa7156080a7bcd90ab32a16

SHA256
f1dc920869794df3e258f42f9b99157104cd3f8c14394c1b9d043d6fcda14c0a

SHA512
f50cdf77557160a7294406e1f2d57ca789ec42834881069281e88ac334fbaad901229da0e460b26a1b69724a4adbf9d0e92adba9c3ac86aa1603b857789c1db6

Download Submit
C:\Users\Admin\Downloads\zblg\4

Filesize
759.8MB

MD5
072c94ed55671df73f0ca92f77014715

SHA1
585e1f18f2265793052a1c98622648b5a14dc403

SHA256
b2ff308b87880ca013f0d6e75ca9868d3f4417ea9e876a5e1fcd4827ff1c1cdf

SHA512
5da7babb24fa89698e7cb1bc97b2de97730e4997742458e9ab4fb4c7584780b7c27634e2c7c930813919c8632354ec3a1df110050da1a0fe642c675ceeaba17e

Download Submit