Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2023, 14:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://secure-web.cisco.com/1kMEA5ahCL-3LoYqWn1OKyLPNjsNoAEnoAWV-xMHPl1v8FSmiMhTvA99D6rdIEhwCWzR5_qG66oWseEeJnR1Xzb4J5Yijet6fzS10dFDTLsmfU_ixUGDkP-iPK8SlxlVOhMN9TJQFuYpsQY3l6iDpoHiVelT3qtSahGLIrnh-ErSf0IfrBdnkMliyf1wcstwXcHGIyQueuOH3I25TlorZrBBKapm7eRRi0JYpnJ8QiWcWg4mViYy4jUbu_zeslGSvOZ0tEcupW402HJrsu5hhLHEtHXxqt_G7Ye3PCYzSBJN74dfnF5DOeTaeNuudpkA7ndqsr0PB4mvM73bz-TJ83SB9dXsdTgpQJUvVA7gOqGmTMaXe4B66IMVlUdvxSz3XE8GglJ7C_wGgdKTekUjHmka59drMAes_fz_vfJoRHAVQ1jNjay3oz_v1UFdTOmRiv0-ZgUCGepDZmKCYtEAf4vt7yVdRZhf3xssdZ69IR8pxoZDxjQNtOqRYtiWlIIIv/https%3A%2F%2Fr20.rs6.net%2Ftn.jsp%3Ff%3D001xbDEFimv2MRbpIZ_pceRbQSIlsjwaAW9NOUccgy3T55Lj71ng_S3eKCDLUfKUsho53Fi8RfJMDv8y31AvJj-JwuOSivlOomgg3bEld0Vbu0an-fu-c_ijqdrkPB9yYG7iTDrC0i2xlHTqOJ6h1pCpQ%3D%3D%26c%3D4Q0U8VEdpovkm3Cm2pQ_mlr0zwgGNgsMjVneq4-07MHMhc63K_jyYg%3D%3D%26ch%3DnfSeCl3ynUhVhtlNcMN0h9AA5cTsNz8r298bFL-q3a_-UB7_mSmcOA%3D%3D
Resource
win10v2004-20230703-en
General
-
Target
https://secure-web.cisco.com/1kMEA5ahCL-3LoYqWn1OKyLPNjsNoAEnoAWV-xMHPl1v8FSmiMhTvA99D6rdIEhwCWzR5_qG66oWseEeJnR1Xzb4J5Yijet6fzS10dFDTLsmfU_ixUGDkP-iPK8SlxlVOhMN9TJQFuYpsQY3l6iDpoHiVelT3qtSahGLIrnh-ErSf0IfrBdnkMliyf1wcstwXcHGIyQueuOH3I25TlorZrBBKapm7eRRi0JYpnJ8QiWcWg4mViYy4jUbu_zeslGSvOZ0tEcupW402HJrsu5hhLHEtHXxqt_G7Ye3PCYzSBJN74dfnF5DOeTaeNuudpkA7ndqsr0PB4mvM73bz-TJ83SB9dXsdTgpQJUvVA7gOqGmTMaXe4B66IMVlUdvxSz3XE8GglJ7C_wGgdKTekUjHmka59drMAes_fz_vfJoRHAVQ1jNjay3oz_v1UFdTOmRiv0-ZgUCGepDZmKCYtEAf4vt7yVdRZhf3xssdZ69IR8pxoZDxjQNtOqRYtiWlIIIv/https%3A%2F%2Fr20.rs6.net%2Ftn.jsp%3Ff%3D001xbDEFimv2MRbpIZ_pceRbQSIlsjwaAW9NOUccgy3T55Lj71ng_S3eKCDLUfKUsho53Fi8RfJMDv8y31AvJj-JwuOSivlOomgg3bEld0Vbu0an-fu-c_ijqdrkPB9yYG7iTDrC0i2xlHTqOJ6h1pCpQ%3D%3D%26c%3D4Q0U8VEdpovkm3Cm2pQ_mlr0zwgGNgsMjVneq4-07MHMhc63K_jyYg%3D%3D%26ch%3DnfSeCl3ynUhVhtlNcMN0h9AA5cTsNz8r298bFL-q3a_-UB7_mSmcOA%3D%3D
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EB4C0E52-1E35-40BC-8FBE-D122DAE3C744}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4536 chrome.exe 4536 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe Token: SeShutdownPrivilege 4664 chrome.exe Token: SeCreatePagefilePrivilege 4664 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe 4664 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1332 4664 chrome.exe 17 PID 4664 wrote to memory of 1332 4664 chrome.exe 17 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 456 4664 chrome.exe 88 PID 4664 wrote to memory of 1004 4664 chrome.exe 89 PID 4664 wrote to memory of 1004 4664 chrome.exe 89 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 PID 4664 wrote to memory of 2980 4664 chrome.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://secure-web.cisco.com/1kMEA5ahCL-3LoYqWn1OKyLPNjsNoAEnoAWV-xMHPl1v8FSmiMhTvA99D6rdIEhwCWzR5_qG66oWseEeJnR1Xzb4J5Yijet6fzS10dFDTLsmfU_ixUGDkP-iPK8SlxlVOhMN9TJQFuYpsQY3l6iDpoHiVelT3qtSahGLIrnh-ErSf0IfrBdnkMliyf1wcstwXcHGIyQueuOH3I25TlorZrBBKapm7eRRi0JYpnJ8QiWcWg4mViYy4jUbu_zeslGSvOZ0tEcupW402HJrsu5hhLHEtHXxqt_G7Ye3PCYzSBJN74dfnF5DOeTaeNuudpkA7ndqsr0PB4mvM73bz-TJ83SB9dXsdTgpQJUvVA7gOqGmTMaXe4B66IMVlUdvxSz3XE8GglJ7C_wGgdKTekUjHmka59drMAes_fz_vfJoRHAVQ1jNjay3oz_v1UFdTOmRiv0-ZgUCGepDZmKCYtEAf4vt7yVdRZhf3xssdZ69IR8pxoZDxjQNtOqRYtiWlIIIv/https%3A%2F%2Fr20.rs6.net%2Ftn.jsp%3Ff%3D001xbDEFimv2MRbpIZ_pceRbQSIlsjwaAW9NOUccgy3T55Lj71ng_S3eKCDLUfKUsho53Fi8RfJMDv8y31AvJj-JwuOSivlOomgg3bEld0Vbu0an-fu-c_ijqdrkPB9yYG7iTDrC0i2xlHTqOJ6h1pCpQ%3D%3D%26c%3D4Q0U8VEdpovkm3Cm2pQ_mlr0zwgGNgsMjVneq4-07MHMhc63K_jyYg%3D%3D%26ch%3DnfSeCl3ynUhVhtlNcMN0h9AA5cTsNz8r298bFL-q3a_-UB7_mSmcOA%3D%3D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5e9a9758,0x7ffa5e9a9768,0x7ffa5e9a97782⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:22⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:82⤵PID:1004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:12⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:82⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:82⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:82⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4512 --field-trial-handle=1896,i,2555832717819032769,10745351912784811431,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2308
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55272384fc61cc69d54e1a448f08a37e6
SHA1662b6d4ba8bc1df03246c19110a7462dd19a4d72
SHA256887af6d7458a17a43fdf99405d4996baa9bc13862834bfdcbe20ba8aa2f2d1a4
SHA5121468ef04d44d830b96cedb00b5b7443d44d9835cf08219f043fa9d42e165bfa98f30b094842544a75562ca385f0b4de9b655c8112c48889047cc6101c3570105
-
Filesize
6KB
MD5b535c35e7993b761da19ef28c40bb4d3
SHA172b389a4df6ff6fe4d086e8ace6080fd9683e462
SHA256d6002760b243fdceb4d03de7fdb08cafb357e6396b8a8a663fad060f2f5de808
SHA512a67ef95e0e401d96d0ace86110d8cbfa66eeb3ae72487859fdfb2af2138a39ad0144c7b32d36f4c81b28f03c62cdf37c4d14c3682b39bd27d551cc46dca8bdab
-
Filesize
6KB
MD5f8ada93876aa919f3d28215ed076cccd
SHA11b4eb79b28e848f033c37ec48144322e6bce8432
SHA256a1668bbeba24d213417d099f6e7808166f2210be239b5fb33849fabed2be5156
SHA512e2562c3acf7b60198eae722250081cb301f990c39da8e7510cc59178bc9a311d88cd768aab6844d686e3e255da2228ab213f6ea3dedc03b1ed127440c8b59148
-
Filesize
173KB
MD556fceaba4cb7af4e9280e43fecc8bfd5
SHA14c8aa2dd07cbb60c5c470cf18c122a1978f3be84
SHA256721d7ecf6d795121e93308982f7b948a7d3c35bfdfc5ee6b0b15538abd2151f2
SHA512f3258bf85edb50ec6cb3080a05c7fa498ed43dd8c91c176b20e9c47ec291bd2a7ccdf3e9bc4766f96a9ccc97f1827b6f0a587ab881a2a9f0469da7a1e6fd94d1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd