fb1aac41613b184907b5555fb6261e1f1266ca4626aa4da92ef10619d0d5fd3e

Resubmissions

11/10/2023, 09:34

231011-lj1z5sea31 4

11/10/2023, 09:29

231011-lfzmxafg75 3

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sublime_text_build_4152_x64.zip
Size

22.0MB
MD5

bb3ac74c8d7f4ea1a7a5a115dbbe3423
SHA1

65567ed8b5edf8939a717e7ec1d29fc20e8c2a3d
SHA256

fb1aac41613b184907b5555fb6261e1f1266ca4626aa4da92ef10619d0d5fd3e
SHA512

37e7a4973266bd30563ac707781d4e220e3b9fc8297ff7a394fe83cc2426a79159c545bdce4d14aaebe46578428b9771f410378ea83211738c9e7b7c77c6d88f
SSDEEP

393216:z47ICmxfHxDGBlZQYLMr2udiqk4xETp/BV9D0C37mcdBLsyVdLSU41jw29hR2nBq:z47ICY1alH02udXk4xEV/BV9D0+ScdJK

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133414904155688024"	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2852	WINWORD.EXE
2852	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
4352	chrome.exe
4352	chrome.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	taskmgr.exe
Token: SeSystemProfilePrivilege	1684	taskmgr.exe
Token: SeCreateGlobalPrivilege	1684	taskmgr.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe
1684	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2852	WINWORD.EXE
2852	WINWORD.EXE
2852	WINWORD.EXE
2852	WINWORD.EXE
2852	WINWORD.EXE
2852	WINWORD.EXE
2852	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4220	4352	chrome.exe	115
PID 4352 wrote to memory of 4220	4352	chrome.exe	115
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 3812	4352	chrome.exe	117
PID 4352 wrote to memory of 1436	4352	chrome.exe	116
PID 4352 wrote to memory of 1436	4352	chrome.exe	116
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118
PID 4352 wrote to memory of 5004	4352	chrome.exe	118

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sublime_text_build_4152_x64.zip
1⤵
PID:3892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1684

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa727a9758,0x7ffa727a9768,0x7ffa727a9778
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5000 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5064 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1920,i,7521614862484058835,13731651332314342026,131072 /prefetch:8
  2⤵
  PID:5616

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
742135a14a21d40e560519311a2beb8e

SHA1
5c71e75e39e1a8a5c1774be754383989bccbdd19

SHA256
7ce729ff724dbc1a854e72940b13816c2adcbbb47e706a64632b508a106702b1

SHA512
089370cf89143b1de2def1946a68260293d5a0af267b650efa4b2d3dbe3b5076e2faecae614ec90b750cf4200b0bb84d43494cb325884c98b18b0d490fa08322

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
aee169184a75d22a5fbcb07c32646314

SHA1
d3d9cd9f01ee9348ff89d00ac3ade00cfcca95b4

SHA256
9be7a0286828d1aa788ef0f939a7a562193d1ac0f2806de3a3059f53f8e0adfb

SHA512
0494d3f6e9706d87c8560c52e62527e76b5b1f232b1c2837d9223e5f64b862cdcd5d767d4f423d8092258686f0a8cfb8391ca06e12447288ab4833b60bf6221a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f117611f4ca36b888b004c2db2b07cde

SHA1
314773e04d78eb44610aa0cad893d76a8a5897e0

SHA256
f7b62895d531789365f85286ef2fc9c2898e8809c63d6b30b8478abf2d10920d

SHA512
a80557571ca761b5a9f997358c62fb6a00786a178e85701328e44005ee5eb4c012cab02e08e13c0a934fb40fa9915f6c720925e64edd2fcf7f4f287bfa32d86a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
204KB

MD5
391d60def2a6a1bec3d47611048fc103

SHA1
5e46e97d5bf650d2d9f454c26c14e0105db257ac

SHA256
06e0ff6924f7118a415ca004ecb2189a424e5f04d4e5e0d08596b66280cb9ac6

SHA512
d1ed112bc071d0928045885972ec790807c1085c9fda240bf8ecd5b80a7fd756d5cb4b8aafd35bc64bfe28147d49bf8c6391160f3459e6f432a780c52b4d17f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
4566d1d70073cd75fe35acb78ff9d082

SHA1
f602ecc057a3c19aa07671b34b4fdd662aa033cc

SHA256
fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0

SHA512
b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8

Download Submit
memory/1684-11-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-8-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-6-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-9-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-10-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-12-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-7-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-2-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/1684-0-0x000002DD933C0000-0x000002DD933C1000-memory.dmp

Filesize
4KB

Download
memory/2852-17-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-67-0x00007FFA50750000-0x00007FFA50760000-memory.dmp

Filesize
64KB

Download
memory/2852-20-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-26-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-27-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-28-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-24-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-23-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-22-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-21-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-66-0x00007FFA50750000-0x00007FFA50760000-memory.dmp

Filesize
64KB

Download
memory/2852-25-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-19-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-18-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-16-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-109-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-110-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-113-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-112-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-111-0x00007FFA52810000-0x00007FFA52820000-memory.dmp

Filesize
64KB

Download
memory/2852-114-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-116-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download
memory/2852-115-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

Filesize
2.0MB

Download