hxxps://zelenka[.]guru/proxy[.]php?link=https%3A%2F%2Fwww[.]mediafire[.]com%2Ffile%2Frw45te8o2nqw35e%2Ffreespoof_%2525255Bunknowncheats[.]me%2525255D_[.]rar%2Ffile&hash=6694f590d3a49ed67de9644f60a92bca

Resubmissions

02/09/2023, 20:12

230902-yyz3lsfd3s 1

02/09/2023, 20:06

230902-yvrxtsff93 7

Analysis

max time kernel
91s
max time network
98s
platform
windows10-1703_x64
resource
win10-20230831-en
resource tags

arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
submitted
02/09/2023, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://zelenka.guru/proxy.php?link=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Frw45te8o2nqw35e%2Ffreespoof_%2525255Bunknowncheats.me%2525255D_.rar%2Ffile&hash=6694f590d3a49ed67de9644f60a92bca

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5552	freespoof_[unknowncheats.me]_.exe
3904	freespoof_[unknowncheats.me]_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133381588815202200"	chrome.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe
Token: SeShutdownPrivilege	2948	chrome.exe
Token: SeCreatePagefilePrivilege	2948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
5052	7zG.exe
5364	7zG.exe
5436	7zG.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
2948	chrome.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe
5692	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3424	2948	chrome.exe	70
PID 2948 wrote to memory of 3424	2948	chrome.exe	70
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3868	2948	chrome.exe	74
PID 2948 wrote to memory of 3780	2948	chrome.exe	72
PID 2948 wrote to memory of 3780	2948	chrome.exe	72
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73
PID 2948 wrote to memory of 832	2948	chrome.exe	73

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zelenka.guru/proxy.php?link=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Frw45te8o2nqw35e%2Ffreespoof_%2525255Bunknowncheats.me%2525255D_.rar%2Ffile&hash=6694f590d3a49ed67de9644f60a92bca
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8835a9758,0x7ff8835a9768,0x7ff8835a9778
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:8
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=304 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4840 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5376 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5516 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5684 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=6272 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6276 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6480 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=6404 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6468 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5496 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6844 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6684 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7024 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7256 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4692 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7288 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2148 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3632 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5156 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6928 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6092 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4504 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7412 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5904 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=7692 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7620 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7420 --field-trial-handle=1844,i,3109844571626886816,11092202450145822823,131072 /prefetch:1
  2⤵
  PID:2136

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap8062:116:7zEvent2096
1⤵
- Suspicious use of FindShellTrayWindow
PID:5052

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap16724:116:7zEvent19480
1⤵
- Suspicious use of FindShellTrayWindow
PID:5364

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap31779:116:7zEvent24417
1⤵
- Suspicious use of FindShellTrayWindow
PID:5436

C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe
"C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe"
1⤵
- Executes dropped EXE
PID:5552

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5692

C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe
"C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe"
1⤵
- Executes dropped EXE
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
cd929eaa5b989fb3f7da05bbe20b97e9

SHA1
7dbb0b3373f335f7654028b2a46283be267eea81

SHA256
0c7fdef7e506a58c7b44b24675a450a05dba8ccdf1b6d2d9a260b4d2b600de20

SHA512
5cef16d2f62cf6fc98b1e94376311a5d8f9a8a457e1d8592ca2771ab61b438e136af4bb77c405fd9048b70c1cc3064b50c08fd95058a09f1cdfea897dc88a581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fb49a6f52508b7d7247514923e74be7f

SHA1
872df45f105bdb0789253f38b0c9e1a17ca0d6b6

SHA256
5e326712efe7a1409e1143ceefd990e5cd3fca567d41fb148e5fcd71a9c8743c

SHA512
d346304f8ffda4a85f810a71b5a9bf81c845a4c02b43be76dc285ef21f5dba4fe8dd3bbd399248228913d4f00e325688a0641cd26728dec782d9f8ecf3231cbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
50d733ca8e07e5540292634b8c03ffe3

SHA1
1e7d2cc56dc6cda55bb0f2c7c4f6ba5709088003

SHA256
c24852f0434b2711e9f35aaf821083e1aafa36b1a0e96a26281e9704ce6aab04

SHA512
d6d01199b31638f6be20eafc3599d614b658721329400fe3c1e9154b782256b4ef2d8ecaf840907776e2f5376fe0e14f334e63543896a53f70cf9e98a20f4988

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
c1195d681d844bc43c1e9bbc0d20cb79

SHA1
04fc6aa01fb5c0088a5c8d03172f100d029bd771

SHA256
1456e4f5306d3aa31482efaa5e88ee397f7d92a3b99ea80d5eb1a0ea0a1d793e

SHA512
7e737f25125a503cf83b9b333014ebf65fd47a820e5e6d7aee77676a2c9294fe80049b781deddbb84572ac9d68a9876777ce49e037c35009de3fe4e359dd9031

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
e9fe6bd2bfc8c812d9abdc8bef5b2ffa

SHA1
61a14266db6815ff4953fdaead50677b8b26dbfc

SHA256
1a3632ec4b411aa15495a452b3e7b07c40b1dceca579a3fd1f4610382ea0b762

SHA512
9d2e7d8bd9e44a1d231142c630966334dcf72036b4e5f6129535ad7fe0b7797d596ded5c5f4e19ca4dc03e1ed19011a641c0611c593a7bf15b5269d9d0e723b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
90874bba1be329ed833de36e1f0f71f3

SHA1
1d8773cb32c1821c7663bf286c55756a1918a18e

SHA256
9ea8f1963c1fe48c8d1a949cf781a1b080842e001a340af240bd8044231e3927

SHA512
a1d95b3620cd0363c8a1118e7a119cdbca96c5bea70c8a5258e550c50f350b0c1591448b082bf89fdcee4b35dd580171697a810abe7ebc3d51ca8dc19c128686

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
5124ad2baee9be5d2a7717beee9868dc

SHA1
e6c854215d5c27b54fe266d76f834e9ed4cb2151

SHA256
ab9ab7edf8e9e9aa42c89fe466bead0fc9f3fe59e7d428bc5242267f19b858f7

SHA512
2962fcf46db09ced279c9adcf7a0ac76731b05d8a2b85d6300fbcd2e8f5165d37465468ffcaaa6474d2e21dff090d7024fd39b4b9fe9debcb3bfdf78369ecc8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
97e63e748b7d93177f96647e6bfc32a0

SHA1
7fba9fe3984bf3bce572a1b09a3d26d78609c175

SHA256
3efaa7ebbd256db433dfbc749da48250dabbc6a3f8afba8d660622c25a323cbf

SHA512
bda9156f1012ccf69adc634da2e1ddc850a52bd12aa667107727b67771c88c3f0c9c1a2f7f66339461aceb04ced7ff66d7ea72e11d43dfeaacbd0332464bda10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ecee259ab0b61805ce61911a73ce0161

SHA1
f06e55c176fa611ae7899cfe9b8f567c51fa0f1c

SHA256
31515a86d6b611c4e779e3a8120d4d1497187528e381036493d6dc22c8ceeb8d

SHA512
46a2a02c973b66269a1284b29274f21c4aa64e3862c565d700f8ed6640df03e85c9ccf46bacda25c57c2e36b2de5b70eeb784948ba3c20ce3e0b7178efcc37ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b4613b91ed2f537582efd716b346b8fd

SHA1
5ccdbed3ad7b6556a044d1e175173de6ef7644ae

SHA256
85f3524feee404981a178836851c805266755099ff14b92399743b828644d363

SHA512
8eb461bc938f2567ea5ef24c88900a91905c1154417feba056ad1ebd479aa165ae2c6eac20bf041e0d20614455024a008f8aa303932b4ad12834e5e179b4527a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
191KB

MD5
ecd7ac1c715de04365dfda47fab8289a

SHA1
f8e03fe135e07a5902609fa3727927e95ca842ab

SHA256
f00444a15ebb0aeb9ddf934838881435fae72ac2a8376969789679e9e2f33efa

SHA512
b66cb628ec004d7d855f6d32ef6a8207ef90369cd21279b91a8e33de9124e8e49b6c246b5b22251692f780ea8616642e8ce73cdeb1a79065cc7ac9ea0743d68a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe

Filesize
2.7MB

MD5
e001605fa695282a2d3170d8d9e956c9

SHA1
4544155daae0335ada1d05a509e43b8c0434ffc8

SHA256
003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e

SHA512
11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6

Download Submit
C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe

Filesize
2.7MB

MD5
e001605fa695282a2d3170d8d9e956c9

SHA1
4544155daae0335ada1d05a509e43b8c0434ffc8

SHA256
003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e

SHA512
11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6

Download Submit
C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.exe

Filesize
2.7MB

MD5
e001605fa695282a2d3170d8d9e956c9

SHA1
4544155daae0335ada1d05a509e43b8c0434ffc8

SHA256
003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e

SHA512
11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6

Download Submit
C:\Users\Admin\Desktop\freespoof_[unknowncheats.me]_.rar

Filesize
1.1MB

MD5
47210dc934bd41c2b6358eea24ef174e

SHA1
2f29db1d87bc99ce8e0998d90f809403c6b8594f

SHA256
2b9c5a938320d4d34fec91a92e6484be1fc9d5383e4f69c771cc965302081b19

SHA512
e013cb22e4fe0ceee98fbf1bb1cb9349070f374f016fa70739493e3f0611b04d1c86834f179da45563cf8dd2ba09646d6c8574bb8c673a7562ef13b6ab781f1a

Download Submit