Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 06:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tellwise-sites.s3.amazonaws.com/img/usr/o-1137277815095499/u-1140386045448336/h-qkWGDkopCzRw8a43ynZQHg/o
Resource
win10v2004-20230703-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
https://tellwise-sites.s3.amazonaws.com/img/usr/o-1137277815095499/u-1140386045448336/h-qkWGDkopCzRw8a43ynZQHg/o
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a69338ef97e94eb4d938c2816c6e0d0000000002000000000010660000000100002000000039748a3c9dc560dec2477fe775e991b16718e2a253ef3f55f06fe1da8fc3306a000000000e80000000020000200000002c660eeb43e7037ff27fdfaa71d83ef72cb129c5254fce9954a3aa6c68798f132000000070a8efcf10648794a3daa84494ee1f8f5365905d612f96b576cecd61121128b040000000986b8259896a43b7deb0cdde6f3f5e81d5dffafe5a1e11708aaa0398e8975c34f88283fe3b487f8b5e1a73e68ffeac39e01addc5edd5ef76111def17ea4ca57e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31051987" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70df2cccd3d0d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c638ccd3d0d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3393624837" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052a69338ef97e94eb4d938c2816c6e0d0000000002000000000010660000000100002000000016494bc717298208eb21536458de1be5be18fdc9566f0ce7ebb8723db5bb91c1000000000e800000000200002000000063c0466fedf3771ccda912ab5b757dc43641c161de37351e0562f6305b65b31b20000000bef9baefe9024ce93d2781577263f2efcb7884cfd74d9123fcb84dc1428d9ae5400000002653e8dd15560f95e514a17b4969f959cae17755792392f861d51944f09d51587b91a144a33be10e87dde8bb12464b1fb48fe25a991669b0975081b64493e92c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3393624837" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F5B61C65-3CC6-11EE-A95E-CADCCB0AB347} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31051987" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133367271558242058" chrome.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 3868 chrome.exe 3868 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe Token: SeShutdownPrivilege 4240 chrome.exe Token: SeCreatePagefilePrivilege 4240 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4052 iexplore.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe 4240 chrome.exe -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 3888 OpenWith.exe 4052 iexplore.exe 4052 iexplore.exe 4060 IEXPLORE.EXE 4060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 1520 4240 chrome.exe 82 PID 4240 wrote to memory of 1520 4240 chrome.exe 82 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2204 4240 chrome.exe 84 PID 4240 wrote to memory of 2176 4240 chrome.exe 85 PID 4240 wrote to memory of 2176 4240 chrome.exe 85 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86 PID 4240 wrote to memory of 3996 4240 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tellwise-sites.s3.amazonaws.com/img/usr/o-1137277815095499/u-1140386045448336/h-qkWGDkopCzRw8a43ynZQHg/o1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd8,0x100,0x104,0xdc,0x108,0x7fff36f69758,0x7fff36f69768,0x7fff36f697782⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:22⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:82⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:12⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:82⤵PID:1224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:82⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2844 --field-trial-handle=1904,i,382999728223954000,1108699040735147546,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1080
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4856
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3888 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\o2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4052 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD55b42ff10144d0b8b0c6030a388d3bb03
SHA105102c1f5ec7a2b781eb454d6baad364f9cc13cb
SHA25622082bf33289945e9d62a4d7c584d3cba5011ad95432d1803c07ac96d74286b4
SHA5129cdfce49c18bb4e6cfd25f524975ce76a2148a790c7189783afc8ffc7855c0afbc10c0f8d18baec44fdcc14aaf585718e484f5f4676f0562464ac1bd833d50b2
-
Filesize
6KB
MD5cfeb23692ea782edf550b5dae6abfcb0
SHA1aebc41af55da715bc548f3700b816c7ac4615625
SHA256aa0c4f878e9c76a0c6a4c792449ae978f0dab8cb47c421f5b1d733f264f9522f
SHA5122bae18dc5bcf7439d464a4eb0dceebab6cba6fdb09ea078648b4d5b209baeba66e7953bbf2b690ec1d17b4716fc570df3193f742e7f87548db59e4ba0e9d7a1c
-
Filesize
87KB
MD5a16d68ab8109bac14f2e4ea081ea0925
SHA1974587125af2a5003185dd95feb34e41288c64f4
SHA2568a31a8fdee7fbc8446f01d98eacb49b09e0542c664a361e1066f8decdff75799
SHA5127fec1a3348eb01b7294a2b67a5c12a2f12e009994e6d7fc78fddcaf42ea43e6a9cf89e05add345ac147cd2252ccfc0644c071bdd44c9d46f850f47cd82b0b169
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
9KB
MD5670e84d10ca3aca965e8923bc1d20c98
SHA18fd46e417ca944841ab7799609658adb6d8b2c72
SHA2563848d99e4528b43ef593c8f1ec430618d454cb7f58b2f064d3d56ea6ce79f135
SHA5129687c1bf6255a5b86936bda87178a8b9729aa6e54e83e65aea304f974b3914305e49cdfc168622678bbd5ea95910b55394de0f5345f08fe3eba5ccb13fde52f2