Analysis
-
max time kernel
1799s -
max time network
1232s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2023 18:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tinyurl.com/4sb5cwh5
Resource
win10v2004-20230621-en
General
-
Target
https://tinyurl.com/4sb5cwh5
Malware Config
Extracted
cryptbot
http://yfive5sb.top/gate.php
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation SetupFile.exe -
Executes dropped EXE 4 IoCs
pid Process 2260 SetupFile.exe 2564 SetupFile.exe 4400 SetupFile.exe 3164 svtast.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 SetupFile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SetupFile.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 SetupFile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SetupFile.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 SetupFile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SetupFile.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2984 4572 WerFault.exe 79 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SetupFile.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SetupFile.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupFile.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3964 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133321060804223828" chrome.exe -
Modifies registry class 56 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000008451ba140aa4d901a8e776d10fa4d901e49c8870cca6d90114000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3024 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 4816 chrome.exe 4816 chrome.exe 2564 SetupFile.exe 2564 SetupFile.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe Token: SeShutdownPrivilege 2756 chrome.exe Token: SeCreatePagefilePrivilege 2756 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe 2756 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4808 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 4900 2756 chrome.exe 78 PID 2756 wrote to memory of 4900 2756 chrome.exe 78 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 3300 2756 chrome.exe 80 PID 2756 wrote to memory of 4396 2756 chrome.exe 81 PID 2756 wrote to memory of 4396 2756 chrome.exe 81 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82 PID 2756 wrote to memory of 640 2756 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://tinyurl.com/4sb5cwh51⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb50d79758,0x7ffb50d79768,0x7ffb50d797782⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:22⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5152 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5620 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5528 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5832 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5860 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5880 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3332 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3700 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6160 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4468 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6100 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2244 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:12⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1752 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6648 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4648 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4640 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:3624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6720 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:82⤵PID:3028
-
-
C:\Users\Admin\Downloads\SetupFile.exe"C:\Users\Admin\Downloads\SetupFile.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6960 --field-trial-handle=1812,i,17524657019925034985,5768598576646452884,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816
-
-
C:\Users\Admin\Downloads\SetupFile.exe"C:\Users\Admin\Downloads\SetupFile.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C Schtasks /create /sc once /f /tr """"C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.exe""" """C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.txt"""" /tn \SrAS\D0B /st 00:02 /ri 1 /du 9353:333⤵PID:896
-
C:\Windows\SysWOW64\schtasks.exeSchtasks /create /sc once /f /tr """"C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.exe""" """C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.txt"""" /tn \SrAS\D0B /st 00:02 /ri 1 /du 9353:334⤵
- Creates scheduled task(s)
PID:3964
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 5 && del "C:\Users\Admin\Downloads\SetupFile.exe"3⤵PID:4352
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- Runs ping.exe
PID:3024
-
-
-
-
C:\Users\Admin\Downloads\SetupFile.exe"C:\Users\Admin\Downloads\SetupFile.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:4400
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4444
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4572 -ip 45721⤵PID:3776
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4572 -s 7721⤵
- Program crash
PID:2984
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2240
-
C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.exeC:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.exe "C:\Users\Admin\AppData\Roaming\6E6C5B2F4782F82B\svtast.txt"1⤵
- Executes dropped EXE
PID:3164
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD540a5b9b07e4e35ce4098882db6c42abb
SHA1ed4c0afa932b63e9843eb3af8631afb1799d8d40
SHA256f893f3a69ec43f7fbd8ec71e66fde915db2f5cdcefe39886304c4f4e337b5269
SHA512c2947e2575d773ad3e4850e43465c831fb58b3f912d4ee28a365c6220f056048c3086465a9c38f88e4d6403948813973870d93c4e477d42109c10cae78ee61b0
-
Filesize
264KB
MD5fd90f303ee67b16c95d5bd45b5bf1ccc
SHA17b1c8b4f06c36bc85b813f6d670620a684479cb3
SHA256a8cf367b727e3c765ceb73cb066abd9e909e9878aa9c9e38218ce81751947fad
SHA512be3bb3cf4d6bf64d7d9331664f3f16fa90f3d7f66dea01fec5489176b511160825d445aa04db4dcc102dc5f307f27d5bf5126f9970072da5562eda2fee1febb0
-
Filesize
5KB
MD58a25107d513f91c3f82c2b6277aed781
SHA1edaa40a5255fd5653487244914fbe6a06fd6e7a4
SHA2562ca92b1676dc14b0736c0e59575c808de1f3f4f248a4ef763de8086fd410ea54
SHA512fa052fc803546918ed5db00ce450bd8c8595573cd61b55be4ef45d2d100c79a4428594593d23759f4661886edeb8176f36578540e9f9bddf9a83262e6cc95fa3
-
Filesize
6KB
MD5f7d48b292a5142cb75ac306b9aea9caf
SHA1efef24128f0a3b9224740bbfecb2849f2669d196
SHA25616e165988a95d2961e4fc5c94b2f6531089f61c3a8285c6de8cdd85a43eea2fb
SHA512f5d7a1e5fa2b505c6392befd066c4f23d1466952491a870c9894a2276aed6ab0adddf9aa1f15b0f61f158d7133a52a4285c17f50884630107d47bc9d168e6c8e
-
Filesize
371B
MD59223a64cf1a71dbc3c110ddf3a86893e
SHA19bd1b750604588f2eb0a9a11f7fcf10facf99816
SHA256a800a44eab087166d8ac6d34e50b5eabb8893dec0f13020ae7bdd0bad51a5a70
SHA512102fe60df769205433b343c677d17109939489a7bc1d149e032cd912f7e3725fc13fb5dc45a0e9f2f69429bbbef3511bc83145e6a2ed5ebf7b0435031a496d77
-
Filesize
1KB
MD56cd4c1b1071574cc25ea2a9093e1aa25
SHA1d73d7f4d998c46cff3537197d6958fa658581681
SHA256528ea7fa43b79cbf68ffd6d68128028a65b33689bfd7f62b3044ffa96be34bc7
SHA51201b4b5ecda157f6850c5709b12182dcd58daed5359f3f296797d66c5912445d74ce64d66c054f0f59b0b753ae74d4f4eadcd62df9432eac03067f2a5fdc28747
-
Filesize
1KB
MD52bf8a34fed8d119b0c8820a631538ae9
SHA1d7ae2c95c10bd617a93081e0ceb616cbf7692556
SHA256b76ce8a6eeadf6bafe76a7a4ed45f9c0739b114fe7489b7885d55ab863418f0d
SHA5124602adbb4c9ee9ea00eb50c41b7f882b97c731989021a744803cf692e43157025ee6d8b8464b6e43ecd63a5b561066373ee22e3a7e71415deaa3a377c5647b21
-
Filesize
1KB
MD545c3a25d03b3a3474d933682e531ab3c
SHA19975801f722038a530cb614269860e19b74cd167
SHA256469ec27480a1774993ee7e007b25f0496ce81cc902e9150eb1eb20292312b272
SHA512cc5c123b04d299cf485d4aed32ad4c9ef4804f74fb8d72e71707feb620d19d925e0d4a04f97b4ec804493e2e86228869100759c7fcbcca7def86944b9f00537e
-
Filesize
1KB
MD51768c38e719c7cdce5c71733388136f6
SHA1ba88655ed3590867794ca7b27a25dce511ca09cd
SHA256519ddc2ff8e6d65e6ad007745eafc5240f52e72de61b1d8a6e3c2fdbe5c11e1e
SHA512935a340d554353f960387d0741aef49550bc6b74d17059011ced3132bd70b9b2d0e17d171ccf02999d3b471a7f685771e24a95daf4b33e9bc414e593b383d720
-
Filesize
1KB
MD5e3545aa9b3adbdfd920be415cacaf483
SHA1cbab630ea8f08492d824440e979065ef6d7bf22d
SHA2564b9fdf0f11955fdad58e51c53306f94f86c87a11bba4c3ec809bddac764b36d4
SHA5128fa661535651e874838d2545a3918a2e684cc22db2352b3f2c2f64adc528299458a81a3838544db745f07b8e50a49a3f1b0e6dcc9a35c9a2fe7041371402fe85
-
Filesize
6KB
MD5f64542934e85295cc2e22d027f859998
SHA1b444538a400530b674f5ff9b678ea64076172baa
SHA256ff08428720b577864358fd9c2962cf73857e4e7b506c6795d42000438d60f43b
SHA51217deca690148f379c10631be01c13bce2ef5390f4963dc184bfc4e7812153d7146efbdc402e55e3f8cf6a8432829f6df271927772682ff245907caff708563c6
-
Filesize
7KB
MD57c233a1a7fe7d96e1dcd472930ae3c6a
SHA14e5f79c5d91d0eb60d3742beafba96673b1437f7
SHA25609759babbe8bfce659e1fe72d63b16bcf230bf4d98bcdd3f90771b2beb494189
SHA512f82cf0c9040b7f715f4cca7cc075c761c4720432690d29ca7d071d6eec62e51d794c9a83d63d425ff9e5654a2d87e14f923dbe3248e57e83feae26afa2e5b064
-
Filesize
6KB
MD511cab07fa5f9e6ccfe41ebba1f76d0e2
SHA1c513bcc8d10bdc1867494ef3cb729e27b7405a2e
SHA25691f3db9ecbc5ce3c975c5f30c81c517d8119ebd944aaada11d3511a7cb8f3e0d
SHA5125e34fdd0c7269706e0cb407a3b6074aa35d5d1810cf76e4dcc913b5d368423acaacd6dd2f5dca17c009352b0c86d46eb9cb68359ae67496c769d684a85da3948
-
Filesize
7KB
MD5a2847edbc7f842896d189f6274ce336d
SHA18f0cdc394614e748297af5df6d1aee7ab5a8846c
SHA256369ce85501a913862c5061fd28c6fa68925d40d80afd73e5d78a94dd6352a83c
SHA5122cfd1a9d54cf345b006e2774d33c7d7a6f0c67f41ab499ee10a7caf1ad04f7fafcc79a77a90de9dd860fc510cd9c21eb0a307b3da16b6b9711b5bba80a20bc51
-
Filesize
15KB
MD537414e09b8526dfbaeae89bc954f15d1
SHA1ee1825040ffd56836c8f3c79ec946de2b90ecb0d
SHA25667ba550201092cf29f5502b6102c5009ba36dbec7af94c7c0a6e9cac37dfc226
SHA512d221743f51b77ad96c9b011e077b74c34988e3cd72df101568dc162e3dd6f2fcda95880b32ee66558a273fff469a539f47f726142f97962ac2e1bfbfeb07b64f
-
Filesize
174KB
MD5e92a5fb45c922a4817e76055b30bb52b
SHA182f547925cbf1f01a1270dace46dbe70ae637e83
SHA256fe6776ce667d1d38e90b8f642376582d3da1a7a25d558c02561fbf2ad098dfa1
SHA51207e9e319cb490afe941064e35e0b639ecf610a555eee3b3c31ca6dd2416e8a3fa4570b22e37cda419afc970b44676293def452c6e0a229f8169c62b71c3e104a
-
Filesize
174KB
MD586dd3ff9d0c9dbb2bbccddb26c2244f8
SHA1e24167be25684306bf56e9efa32f7a716d00231a
SHA256f3a2862a7bbfa94b174c49dae512f596df8f0ad11bcd3a1df48cac09453688cb
SHA512bd2bd2163a21e4487d2f52733ba41e946469797dc6bbb6f748ba72ad1972c666345f1e137cb7b279fb71e5be5eca4b179c3c19f69c8dd38c1a56922fee853d9b
-
Filesize
109KB
MD5a4a5b1e410ca050b2485be624beb4352
SHA1ba8cf805def82d9c546762e4761e15f2d97aaac2
SHA256d010e13c71cd58734c6f2d07e982d64fa11df6200b0bd682e63bfe832aa85e45
SHA51287e38fbf5d9e9471db43fcf16a4a6f3535064b36ed3cf72c6d38233ce0303732a53540ff3e02bd62c95a4b002ec34406b9154d0d0c5f86a508a54072d8583854
-
Filesize
113KB
MD5f9bfbd1e73930940925696f561b8a32d
SHA19aeca3a2fbd27de3edb9a7a641cceb64aee6c288
SHA2565c2d3da3668a265142829b79372a6264ea8d6342c2013ebc7acad20d6cad9fa4
SHA512be664de5ec8ac573d75bf0a03089059a8916154d2966c89dd3e990262cf794cf6a1cbe3dda2b89240d9b7863a93368c4e9232bdb026e0e0d388030e236db9f0e
-
Filesize
117KB
MD562f25638ba521da238c74337eac9723e
SHA1b64aba8cb3b91b81c3b4ae770d6d0ed47cff2931
SHA25665697807ad77a9e3a3a0d95b7104172d840cacb0f6e88c34fa2a52e38ddc043c
SHA512959809c13eb6870811035e6dc29619a852f02a03b9983c44bb9283cfa16ad68d5767e105fe39fc505b0bdc19bd35b1299b5f85aacab66a3a1bff45a7fc05cdaa
-
Filesize
106KB
MD53e19b34925b941b77bb5008d7fa7b486
SHA1703b4c25fbcc4067ee60b047020638c13626cb83
SHA2562a66279a096a13ff2683a5d46b709bf20894384c9c3c98dcd0d7b0dfb901f607
SHA512cd0e8a19c3660047e508c820862ed8bd46d45c3d18d079fb8676884a86fe975a04544ee53e54e9916fae0c9407f599749b490482c1a999cd9a08959f892c9e4d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
32B
MD57baeda56bb35db43871f46fbe9e57fd3
SHA1536ca57c8711def7890c0d990d4e77a927441715
SHA256aeeec9f404103388a0fa034fceb9683cfc2ad8211e7e4eeff78ca6bf0c365192
SHA512704d1f5a7703494aa1904a510f56a68cf77d90f6aaeca254df55d744ac74ad2ae293682dbb4b6cf5657c8018f9aa9ac2532c3ee8abc99526af0bee66ea994e17
-
Filesize
2KB
MD5d009a15812edac85a1f0e73d5a7c8d2a
SHA1facd1d09561ad144f0bc3568dc818097384fadb9
SHA256a859e99f2dbf9f341420500938f58570b2cc3760708e0df9d2ed683bf4dcd6e9
SHA512b8c4a7126540230cd9d3311d7cdb816617f6bac81328d83362b116d43cb88c3f43c8a17702326ad9510ef331a753223ebd4c0c7a7a435fa467011a43d0fb874e
-
Filesize
925KB
MD50adb9b817f1df7807576c2d7068dd931
SHA14a1b94a9a5113106f40cd8ea724703734d15f118
SHA25698e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
-
Filesize
159KB
MD5a761d2a494270c0fdea118af9204b938
SHA1998d07b99f217bf0add2ef11e432467adb392686
SHA25654a99bb4a29413e512efe6801303a9f3947077193c099a886bf74690164bb0d8
SHA5125d34ce0ade55d2f9a2d57e44381066678477d92d779e3dbcd4263511475f6b9a456b64c4057cdd2a827765f4dd747eb67149db23b83f3f87e84535b8af1cec12
-
Filesize
8.6MB
MD5267970874bfc60748e71e8f0665158b7
SHA11719cecaa4b4304b447754389a813810b71d28ed
SHA256ac5c131fc423775c5e840131ee169828b188773713c65c39f68610e4d9d138f5
SHA512924d9af9e9230de6c9ca6d1d5a3938c3df7ca1c62b3a6652d52a3e113b202ececdb55494fec01eaefa91186f829d77e969ab81ea52fd7481522909c1f03a135e
-
Filesize
302.4MB
MD5251e037ea5f3b63d268be6f74e4f2e5d
SHA1eeebc6f9fc2fdf60a4c012f935e3afb9675d14ca
SHA25679bdb4cce6b6815e44f0da4bdeb4882123410c2e51236074e2d10e0e533787f2
SHA512a515e1ae8344e58864274c1531f6819003f5412a1fdea788f54a65b4f1988b09b1e6bf629db9fdccd8508845ed9fd8543a46313d80c2e58d40351d9c9ce83ca8
-
Filesize
302.4MB
MD5251e037ea5f3b63d268be6f74e4f2e5d
SHA1eeebc6f9fc2fdf60a4c012f935e3afb9675d14ca
SHA25679bdb4cce6b6815e44f0da4bdeb4882123410c2e51236074e2d10e0e533787f2
SHA512a515e1ae8344e58864274c1531f6819003f5412a1fdea788f54a65b4f1988b09b1e6bf629db9fdccd8508845ed9fd8543a46313d80c2e58d40351d9c9ce83ca8
-
Filesize
302.4MB
MD5251e037ea5f3b63d268be6f74e4f2e5d
SHA1eeebc6f9fc2fdf60a4c012f935e3afb9675d14ca
SHA25679bdb4cce6b6815e44f0da4bdeb4882123410c2e51236074e2d10e0e533787f2
SHA512a515e1ae8344e58864274c1531f6819003f5412a1fdea788f54a65b4f1988b09b1e6bf629db9fdccd8508845ed9fd8543a46313d80c2e58d40351d9c9ce83ca8
-
Filesize
302.4MB
MD5251e037ea5f3b63d268be6f74e4f2e5d
SHA1eeebc6f9fc2fdf60a4c012f935e3afb9675d14ca
SHA25679bdb4cce6b6815e44f0da4bdeb4882123410c2e51236074e2d10e0e533787f2
SHA512a515e1ae8344e58864274c1531f6819003f5412a1fdea788f54a65b4f1988b09b1e6bf629db9fdccd8508845ed9fd8543a46313d80c2e58d40351d9c9ce83ca8
-
Filesize
302.4MB
MD5251e037ea5f3b63d268be6f74e4f2e5d
SHA1eeebc6f9fc2fdf60a4c012f935e3afb9675d14ca
SHA25679bdb4cce6b6815e44f0da4bdeb4882123410c2e51236074e2d10e0e533787f2
SHA512a515e1ae8344e58864274c1531f6819003f5412a1fdea788f54a65b4f1988b09b1e6bf629db9fdccd8508845ed9fd8543a46313d80c2e58d40351d9c9ce83ca8