hxxp://www[.]EnergyRabbit[.]de

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.EnergyRabbit.de

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413959389079480"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
2240	chrome.exe
2240	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2836	3480	chrome.exe	55
PID 3480 wrote to memory of 2836	3480	chrome.exe	55
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3368	3480	chrome.exe	87
PID 3480 wrote to memory of 3424	3480	chrome.exe	88
PID 3480 wrote to memory of 3424	3480	chrome.exe	88
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89
PID 3480 wrote to memory of 3908	3480	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.EnergyRabbit.de
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff5caf9758,0x7fff5caf9768,0x7fff5caf9778
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1796 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4072 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5368 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4672 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2320 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=872 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5240 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5328 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2308 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5292 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5088 --field-trial-handle=1860,i,5362843095747189389,10955330147926063146,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
100KB

MD5
f134fda98a277b1c8f20ab8fbe2fbd58

SHA1
a922796190a1f5bbb3c410c6ec591502050df04e

SHA256
27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7

SHA512
2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
352205de6af3be74533adf72944cd261

SHA1
794ba85d6960af2775d9ad93a06d12e1a03c683c

SHA256
df1690a9ee7a9fe4eb435ba59e661cd8d37979363f7b5deaa7cb8dd0dbab43bc

SHA512
b6c506d931b139552b9260f5c01a5ee60c0973791a49e4cded291807954adc11c3ebc43a54e7f33225a3d55a6a8bda47b6ccba92c1e2ea1a6b05cda8b2b4fe33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
56af7818de3194b9d8992a18fc965c3b

SHA1
62234f1d1955f66823da4807b3b73bf5827f9b2e

SHA256
13e7c32e71e1368355b5581119930e8067fd80b5d2f501bc8895935e69715717

SHA512
e696e956eb6e6813f1ec749b5b8bc7e2c52715a49ec08bee079e8f6ae45de5fb6e273175c49e18b3c20aa8ebbc3940df8de41e05c7cf2bbb65f91d41aab16714

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
27c00f4752b2ae4039a662ec7e3fe10d

SHA1
b5841e31c863b634de74c0c1f67793961f79cf5c

SHA256
84432a6b96764df1cd3d73f8db93fb95f8a50982725a80a6ad4a9f212a74711e

SHA512
c0eda78e1f3454749f5537d66c8753a581743d3bdfad6b2992e1f611293b7478d4f2831d2099e7890107f369bec6fc220ce1af634c874ed7a172d93f02697da2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3eecb1b44031d039ce9ed70462ca1f9d

SHA1
9ad44b68dadb5d1359bf3dd740244092d57454ad

SHA256
b356bd7698a28b82c9285d8bc7e61435ceb2b80524f737011006605ee020a949

SHA512
6736a418aad1673b5240d5ea989b6ead6f475dbfc84d277896bb2fe6cc16fc1bdcd2b5c5490243224504b5823d974b16b6deb3bf23af714b2185e33a933a75c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c210cd25f303431b5e323677715b11a5

SHA1
1dc3833e526fc7ebec3eb26212e2e798bd8fc9d4

SHA256
c65895eacd05036cb975c26483b1c6aa0281f80b07c472d7f21d50cd7735a34a

SHA512
b1fa37bb490bd20132a961b35bc279e1a14b19bba39f780091bddb5ec07573d1719562de13f7f1040bd8fdc4592a0796fadb3ec03a4e59c19b27ce117a8b72aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
36a257bfb0f24331b555e75850f1342d

SHA1
2fa920b17293598c9fe62d47ab0aafe6d33cae11

SHA256
7a92a2407f4f390f2fc9cf53324daed45ed090fed5f1a1b8c469d167fc03c88e

SHA512
21098345dd85e28b1e4a01809269a998177b3773c446f3ff859a3920fb727c2e1b07fa299acc0d21825d86a3302829a3bde212ae5edde9e629dff78624b14433

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f2091ec9e32adbb7a2583181a29e5453

SHA1
e44dbf68fe2f946ffab6f2ba92b1fdf2201c5c71

SHA256
de8e611cd43a9349b25bb96b9842d06adf84b0a90f2ff90f56d48c141461f6f6

SHA512
d40ae0de3c6335e357d72c8a49a3f1cd90c8a711a3d8b45df68c2b98a5a618cb14702715b93dc36c98162734a5fb86d7d803e3b0ba7e987779e2911f62a1767f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
754d4a91cba82cb9b53592d2914ef906

SHA1
af2d178eb505e56a5a76e89ef80218dcfdb3b9b6

SHA256
d618ecbae221f2e1f99ef5f559b20b4d551c0417ff8f5c0f52f65526d1b7c855

SHA512
259bee89ea1bb4db16b79e04341a649eb307f8ce5d739f98b8c6f1292537302de8d5be0ec178a636c70118999778bc7dc3c91bbe27764bb8350aff21cbeffdef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
57d4ffcce09fa75f002bb669a97cc6d1

SHA1
0844fb4432524a885d70c09cbe33d9b87192210d

SHA256
4a70b8693f8c5d8011b19ac7f86b0388c0ef42ae32c932f13ef8aa9a45fb20dd

SHA512
84f4fc4cbb0f1bd46e12a267373211b6ced6825083bfe99a597254cb530d85195243c6bca1067e0fcd2919e0c70ef54813344709c1e173fa329f73bb6d51fe4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
cbcbf37cfb2baab5c95cb729b1aa9633

SHA1
d971cc46947ba9180eba3be530358c3424edec3a

SHA256
f9af972c23c108088fb66f68785d5b12cea39d08dd922a31f0ba539a4044a737

SHA512
e391b1940b26f4f2743422ab5995db78ce693e4f928b9723fc91718bd10bd2be2c65e098f857fe902925fc9bc1f9de5905384bf623c1c11e2429ce15699bd2e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe587644.TMP

Filesize
97KB

MD5
b3468f69bcc53088a04bc477755d0924

SHA1
d936f746ff2a7c3a5827fb492e290c31ed888356

SHA256
784a021f5ae82c752577e9014b959d7983479dc52f9d49954f5f2c7396af9f87

SHA512
27a5ddcc25e32aa97b4dd4fe6fb249e35e097d12a6722d57818b40f4bda9c588d556fdac761d7c0b014f17af5fd5baf38cf1116a1ba90fcbce76872af71b6271

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit