Analysis
-
max time kernel
208s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
03-07-2023 04:50
Static task
static1
Behavioral task
behavioral1
Sample
02bd842c7b587c145a18836f8180846c.exe
Resource
win7-20230621-en
General
-
Target
02bd842c7b587c145a18836f8180846c.exe
-
Size
284KB
-
MD5
02bd842c7b587c145a18836f8180846c
-
SHA1
9a17bab1f56906321a4574e87b6720ab24946b3d
-
SHA256
f4d358d649b4194238e4f9ef8fc2722da3aa8fb6a9eb89e590359fbed7205989
-
SHA512
d8bcad2d452f51bfbfde6dc6546d9893e9a869c7475962626c60b54187d6937f6114aa3ef0bc1fac20f9e55ebdcee952630797dc24cf54f4779230add820c7d2
-
SSDEEP
6144:uiOJeNdupo0RmQt9zt1ZRtK8Q9HcPtmCmptGGsBYW/6d9Yr:nhfm3RRtDuH8tFYGGsz6dS
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
explorer.exe02bd842c7b587c145a18836f8180846c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "wvgwietl.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myq777i33m715.exe 02bd842c7b587c145a18836f8180846c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\myq777i33m715.exe\DisableExceptionChainValidation 02bd842c7b587c145a18836f8180846c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
explorer.exechrome.exeEXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Device Driver Setup 1.2.510.2001 = "C:\\ProgramData\\Device Driver Setup\\myq777i33m715.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\Device Driver Setup 1.2.510.2001 = "\"C:\\ProgramData\\Device Driver Setup\\myq777i33m715.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Run\Device Driver Setup 1.2.510.2001 = "\"C:\\ProgramData\\Device Driver Setup\\myq777i33m715.exe\"" EXCEL.EXE -
Processes:
02bd842c7b587c145a18836f8180846c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 02bd842c7b587c145a18836f8180846c.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum EXCEL.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 EXCEL.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exeexplorer.exeEXCEL.EXEpid process 928 02bd842c7b587c145a18836f8180846c.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exedescription pid process target process PID 1924 set thread context of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exe02bd842c7b587c145a18836f8180846c.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 02bd842c7b587c145a18836f8180846c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 02bd842c7b587c145a18836f8180846c.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
explorer.exechrome.exeEXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
EXCEL.EXEexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
vlc.exeEXCEL.EXEpid process 1772 vlc.exe 1740 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exeexplorer.exechrome.exepid process 1924 02bd842c7b587c145a18836f8180846c.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1620 chrome.exe 1620 chrome.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1772 vlc.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exeexplorer.exepid process 928 02bd842c7b587c145a18836f8180846c.exe 928 02bd842c7b587c145a18836f8180846c.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exepid process 928 02bd842c7b587c145a18836f8180846c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exeexplorer.exechrome.exedescription pid process Token: SeDebugPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeRestorePrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeBackupPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeLoadDriverPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeCreatePagefilePrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeShutdownPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeTakeOwnershipPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeChangeNotifyPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeCreateTokenPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeMachineAccountPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeSecurityPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeAssignPrimaryTokenPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: SeCreateGlobalPrivilege 928 02bd842c7b587c145a18836f8180846c.exe Token: 33 928 02bd842c7b587c145a18836f8180846c.exe Token: SeDebugPrivilege 1664 explorer.exe Token: SeRestorePrivilege 1664 explorer.exe Token: SeBackupPrivilege 1664 explorer.exe Token: SeLoadDriverPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeTakeOwnershipPrivilege 1664 explorer.exe Token: SeChangeNotifyPrivilege 1664 explorer.exe Token: SeCreateTokenPrivilege 1664 explorer.exe Token: SeMachineAccountPrivilege 1664 explorer.exe Token: SeSecurityPrivilege 1664 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1664 explorer.exe Token: SeCreateGlobalPrivilege 1664 explorer.exe Token: 33 1664 explorer.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe Token: SeShutdownPrivilege 1620 chrome.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
vlc.exechrome.exepid process 1772 vlc.exe 1772 vlc.exe 1772 vlc.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1772 vlc.exe -
Suspicious use of SendNotifyMessage 35 IoCs
Processes:
vlc.exechrome.exepid process 1772 vlc.exe 1772 vlc.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1620 chrome.exe 1772 vlc.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exevlc.exeEXCEL.EXEpid process 1924 02bd842c7b587c145a18836f8180846c.exe 1924 02bd842c7b587c145a18836f8180846c.exe 1772 vlc.exe 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
02bd842c7b587c145a18836f8180846c.exe02bd842c7b587c145a18836f8180846c.exeexplorer.exechrome.exedescription pid process target process PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 1924 wrote to memory of 928 1924 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 928 wrote to memory of 1664 928 02bd842c7b587c145a18836f8180846c.exe explorer.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1156 1664 explorer.exe Dwm.exe PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1664 wrote to memory of 1184 1664 explorer.exe Explorer.EXE PID 1620 wrote to memory of 1544 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1544 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1544 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe PID 1620 wrote to memory of 1744 1620 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"3⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63e9758,0x7fef63e9768,0x7fef63e97783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2252 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3492 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3840 --field-trial-handle=1348,i,13621715767456390715,4029241081137169657,131072 /prefetch:83⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\EnterMove.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde2⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1b42e6c0-d029-433b-ac36-a0435e2a04bf.tmpFilesize
172KB
MD5159ddaa6f7938e59a5d3d088921ce19e
SHA1b6d56676eb651223103f8bc94698aa6c2d581db7
SHA256df6dbe0485bd107ac51d66da6ad5b640e4d719c046317cb739be7993e9c75238
SHA51233cdc3028d8a91e4e552bc9790af16243f46d84b03d931040b9245bdda3da2ad6b54962c3f598916211f5cf13f18306b261e7c89d7734e1fef88ef67750b28e8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD55e019d91dc8d1cb622f335b76f497bce
SHA1050eb61eae5de58202a42a7836298d40cf05bc40
SHA256cead0bb81c46291555e8f9f568eedcecd37196db8ff404eccb500be1980909bd
SHA512a992cc5226b154d0b603f6fb1e89cbc9970024bab11a763a69f5b41f618e88b6d857bce0373305f04a6c72ef883afeab6be10003dde048c2c89179be7afb778f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmpFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
172KB
MD52189fd56b52542be655c533d6b4e75b9
SHA1a54fd22dbcfd8c262d35f437ae7bdc5e16de2ff5
SHA256daf28302ad921c1800f66e4ea4ce0c15b9f8fd4f11cca67179c7dbdcd950a4a9
SHA512eedb46e7199e420edb67c587ce4a8a1aacacd3d99cf18bb454295803eaaad327217e5ed9684d52e74b5184a596ac5f59e217bd5a17d8474fd998bf7b1fe7d8ae
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1620_TTWLUDZRYDDTALFQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/928-70-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-74-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/928-62-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-63-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-64-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-65-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-66-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/928-68-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-60-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-71-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/928-72-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-73-0x00000000018C0000-0x0000000001926000-memory.dmpFilesize
408KB
-
memory/928-61-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-75-0x00000000018C0000-0x0000000001926000-memory.dmpFilesize
408KB
-
memory/928-77-0x00000000002C0000-0x00000000002CD000-memory.dmpFilesize
52KB
-
memory/928-78-0x0000000001930000-0x0000000001931000-memory.dmpFilesize
4KB
-
memory/928-79-0x0000000003250000-0x000000000325C000-memory.dmpFilesize
48KB
-
memory/928-80-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/928-94-0x00000000018C0000-0x0000000001926000-memory.dmpFilesize
408KB
-
memory/928-54-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/928-58-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-57-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-56-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/928-55-0x0000000000400000-0x00000000018B4000-memory.dmpFilesize
20.7MB
-
memory/1184-109-0x0000000002210000-0x0000000002216000-memory.dmpFilesize
24KB
-
memory/1664-100-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-108-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/1664-90-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/1664-91-0x0000000000310000-0x000000000031C000-memory.dmpFilesize
48KB
-
memory/1664-95-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-96-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-97-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1664-98-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-99-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-88-0x0000000000090000-0x0000000000141000-memory.dmpFilesize
708KB
-
memory/1664-101-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-102-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-103-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-104-0x0000000000090000-0x0000000000141000-memory.dmpFilesize
708KB
-
memory/1664-105-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-106-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-107-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-82-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-85-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-110-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-112-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-83-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-81-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-86-0x0000000077030000-0x00000000771B1000-memory.dmpFilesize
1.5MB
-
memory/1664-87-0x0000000000090000-0x0000000000141000-memory.dmpFilesize
708KB
-
memory/1740-331-0x0000000004290000-0x0000000004341000-memory.dmpFilesize
708KB
-
memory/1740-158-0x0000000004290000-0x0000000004341000-memory.dmpFilesize
708KB
-
memory/1740-326-0x0000000002FD0000-0x0000000002FDC000-memory.dmpFilesize
48KB
-
memory/1740-157-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1740-327-0x0000000002FC0000-0x0000000002FC1000-memory.dmpFilesize
4KB
-
memory/1740-325-0x0000000002F20000-0x0000000002F26000-memory.dmpFilesize
24KB
-
memory/1740-324-0x0000000004290000-0x0000000004341000-memory.dmpFilesize
708KB
-
memory/1740-156-0x0000000004290000-0x0000000004341000-memory.dmpFilesize
708KB
-
memory/1740-155-0x0000000004290000-0x0000000004341000-memory.dmpFilesize
708KB
-
memory/1772-161-0x0000000076E50000-0x0000000076FF9000-memory.dmpFilesize
1.7MB
-
memory/1772-186-0x000007FEF5B00000-0x000007FEF5B1D000-memory.dmpFilesize
116KB
-
memory/1772-227-0x000007FEF5AE0000-0x000007FEF5AF1000-memory.dmpFilesize
68KB
-
memory/1772-185-0x000007FEF5B20000-0x000007FEF5B31000-memory.dmpFilesize
68KB
-
memory/1772-184-0x000007FEF5B40000-0x000007FEF5B57000-memory.dmpFilesize
92KB
-
memory/1772-238-0x000007FEF58E0000-0x000007FEF5AE0000-memory.dmpFilesize
2.0MB
-
memory/1772-183-0x000007FEF6110000-0x000007FEF6121000-memory.dmpFilesize
68KB
-
memory/1772-251-0x000007FEF47F0000-0x000007FEF482F000-memory.dmpFilesize
252KB
-
memory/1772-248-0x000007FEF4830000-0x000007FEF58DB000-memory.dmpFilesize
16.7MB
-
memory/1772-252-0x000007FEF47C0000-0x000007FEF47E1000-memory.dmpFilesize
132KB
-
memory/1772-253-0x000007FEF47A0000-0x000007FEF47B8000-memory.dmpFilesize
96KB
-
memory/1772-254-0x000007FEF4780000-0x000007FEF4791000-memory.dmpFilesize
68KB
-
memory/1772-255-0x000007FEF4760000-0x000007FEF4771000-memory.dmpFilesize
68KB
-
memory/1772-319-0x0000000002340000-0x0000000002346000-memory.dmpFilesize
24KB
-
memory/1772-182-0x000007FEF6130000-0x000007FEF6147000-memory.dmpFilesize
92KB
-
memory/1772-181-0x000007FEF6540000-0x000007FEF6558000-memory.dmpFilesize
96KB
-
memory/1772-167-0x000007FEF5BB0000-0x000007FEF5E64000-memory.dmpFilesize
2.7MB
-
memory/1772-162-0x000007FEFAAC0000-0x000007FEFAAF4000-memory.dmpFilesize
208KB
-
memory/1772-159-0x000000013F4E0000-0x000000013F5D8000-memory.dmpFilesize
992KB
-
memory/1924-59-0x00000000002E0000-0x00000000002E5000-memory.dmpFilesize
20KB