Resubmissions
02/09/2023, 19:18
230902-xz79yafb5y18/06/2023, 15:24
230618-stfkhsga791018/06/2023, 15:22
230618-sr1gxaga721009/06/2023, 08:57
230609-kwvhfsbf7909/06/2023, 06:24
230609-g57mlabh4x07/06/2023, 11:48
230607-nyfzmahh267Analysis
- max time kernel
165s - max time network
133s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
18/06/2023, 15:24
Behavioral task
behavioral1
Sample
178.jar
Resource
win7-20230220-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
178.jar
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
300 seconds
General
- Target 178.jar
- Size 13.9MB
- Sample230618-stfkhsga79
- SHA256 41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919
- MD5 a7eeab7e2e90d0373ebfb15243bff81a
- SHA1 fc32670a240a9e42ba6c453a68dec0933a85355f
- SHA512 bec9fe1bd4305326e307a9ebeb17d7e4ba3c4f0bc108e7d39c93a74faee174b762bb06a4ef7c4e04f4284c4e6c351aac249e74619d473a4539436e28a82a066f
- SSDEEP 196608:pYBQXEPt5WaR6SynIRkIqZ81rI61CYYY+YA+X3vMMIYlRCu+EGlYxMrdhMTbnb:8rt5WaRRkZ81rtTidk/MMUlwmhMTLb
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini solitaire.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini solitaire.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats solitaire.exe Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0" solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF} solitaire.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Local Settings solitaire.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 1636 chrome.exe 1636 chrome.exe 2244 taskmgr.exe 2244 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 468 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 468 taskmgr.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeDebugPrivilege 2244 taskmgr.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: SeShutdownPrivilege 1636 chrome.exe Token: 33 2296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2296 AUDIODG.EXE Token: 33 2296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2296 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 468 taskmgr.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe 1636 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 856 1636 chrome.exe 31 PID 1636 wrote to memory of 856 1636 chrome.exe 31 PID 1636 wrote to memory of 856 1636 chrome.exe 31 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1168 1636 chrome.exe 33 PID 1636 wrote to memory of 1744 1636 chrome.exe 34 PID 1636 wrote to memory of 1744 1636 chrome.exe 34 PID 1636 wrote to memory of 1744 1636 chrome.exe 34 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35 PID 1636 wrote to memory of 1424 1636 chrome.exe 35
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\178.jar1⤵PID:2028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:468
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b89758,0x7fef6b89768,0x7fef6b897782⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:22⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:12⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:12⤵PID:268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1496 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:22⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1080 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1336 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3816 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:12⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4040 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3740 --field-trial-handle=1276,i,2169375907952467415,1810314860623988576,131072 /prefetch:12⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1544
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2464
-
C:\Program Files\Microsoft Games\solitaire\solitaire.exe"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:2376
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4681⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵PID:2724
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\178.jar"1⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\ose00000.exe"C:\Users\Admin\AppData\Local\Temp\ose00000.exe"1⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\ose00000.exe"C:\Users\Admin\AppData\Local\Temp\ose00000.exe"1⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\ose00000.exe"C:\Users\Admin\AppData\Local\Temp\ose00000.exe"1⤵PID:2696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0e28d494-f181-4dbe-859c-6e529f9b232c.tmp
- Size 157KB
- SHA256 ee6df80ddd0b6a17e14305e600b03e5dcfb5698549bd263c8a54616b0537a6f0
- MD5 f03f8bd86754ac1ac99c94a0e55fce77
- SHA1 1527256209637c0a63fdbab18675394b62d85544
- SHA512 1ff28512001a4ade915eb96d37cc86f2a7a71a505159d839bb1f7ef0413906119903234c01aa73ae1346c221a00b495033fb89917a7343652f8179bf63122591
- SSDEEP 3072:A3TJEgA/ippXZOsFALyNrluvzRcFJHH/Q/6Zp/viVwg0GOM7VzW:A3hA/yOeXNrlOcFJH4/S/viVLjhq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 4KB
- SHA256 1475ba484dfb87c7123d277a9e0960377b00bc0f7776ca5e4f09cac078e4588f
- MD5 7b8eebbcfddeae87b85cc0f645cfe4b3
- SHA1 a29fd82cf0723c86b01a213a7d744b97d9b96363
- SHA512 4715ddb67df47ef99f00dc5116b8992d35babdd4131973b59120d42121b2e2f3541932d3912d56683d9ceb21ed9e50e971b311ed249e2395c3c726003cd501e0
- SSDEEP 96:76Ij9KIW6VTd8iZRy7Di+6MsmdebIOyPYgMjV1:7f9V58syy+FSXH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000004.dbtmp
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 157KB
- SHA256 7226f826b62a009dbd3ac4157fa8c700bdf024f2d44f4fa6617079417b9f6f1b
- MD5 1d7394f144b68a9e214e526b042c1bbb
- SHA1 033f86094cc6cc4b952cd812d24ad96590c58ce6
- SHA512 a669c9efd68c3e789c54f651a809d19fd5917d22fd1a2a3b361ad1bde927affd0b0ff7f193f1f0d08cbfc2115802ef3f4c2d4d923622b7d0f9c692e60486abfb
- SSDEEP 3072:X3TJEgA/ippXZOsFALyNrluvzRcFJHH/Q/6Zp/viVwg0GOM7VzW:X3hA/yOeXNrlOcFJH4/S/viVLjhq
- MD5 SHA1 SHA512 SSDEEP